| शीर्षक | SourceCodester Leave Application System in PHP and SQLite3 1.0 Improper Authorization |
|---|
| विवरण | The Leave Application System in PHP and SQLite3 is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the user management functionality.
The application allows authenticated users to access and modify other user accounts by manipulating the id parameter in the URL.
Example vulnerable endpoint:
?page=manage_user&id=1
By changing the id parameter value, attackers can access other users' accounts:
?page=manage_user&id=2
?page=manage_user&id=3
The application loads different user profiles based solely on the ID value without performing proper authorization checks.
This vulnerability may allow attackers to access sensitive user information, modify other user accounts, and potentially escalate privileges. |
|---|
| स्रोत | ⚠️ https://medium.com/@hemantrajbhati5555/insecure-direct-object-reference-idor-in-leave-application-system-php-sqlite3-66af35b8b6ea |
|---|
| उपयोगकर्ता | Hemant Raj Bhati (UID 95613) |
|---|
| सबमिशन | 16/03/2026 12:33 PM (7 महीनों पहले) |
|---|
| संयम | 01/04/2026 03:18 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 354657 [SourceCodester Leave Application System 1.0 User Information index.php?page=manage_user पहचान अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|