| शीर्षक | SourceCodester Student Result Management System 1.0 Improper Access Controls |
|---|
| विवरण | A critical vulnerability was found in SourceCodester Student Result Management System 1.0. The vulnerability is located in the /srms/script/admin/core/update_smtp.php file.
The application fails to perform any authentication or authorization checks before processing POST requests to update the mail server settings. This allows an unauthenticated remote attacker to modify the system's SMTP configuration (Host, Username, Password, Port) via a crafted HTTP POST request.
Impact: By hijacking the SMTP configuration and pointing it to a malicious server controlled by the attacker, the attacker can intercept the "Forgot Password" reset link meant for the administrator. This leads to a full Account Takeover (ATO) of the Administrator account without prior access credentials. |
|---|
| स्रोत | ⚠️ https://github.com/Shaon-Xis/SRMS-1.0---Unauthenticated-SMTP-Hijacking-to-Account-Takeover |
|---|
| उपयोगकर्ता | yan1451 (UID 94854) |
|---|
| सबमिशन | 10/02/2026 03:57 PM (8 महीनों पहले) |
|---|
| संयम | 21/02/2026 04:08 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 347310 [SourceCodester Student Result Management System 1.0 update_smtp.php अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|