| शीर्षक | sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 Unauthenticated Access |
|---|
| विवरण | Every backend dashboard and data‑manipulation script in the application fails to enforce proper session‑based authentication. Each file begins with session_start();, but no check is performed to verify that a valid user session exists (e.g., if (!isset($_SESSION['email'])) { … }).
Because of this missing validation, an unauthenticated attacker can directly access administrative panels (admin, student, teacher dashboards) and all corresponding CRUD actions via their raw URLs. This exposes the entire application data and functionality to anyone who knows or guesses the file names. |
|---|
| स्रोत | ⚠️ https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/1 |
|---|
| उपयोगकर्ता | Harry_You (UID 97667) |
|---|
| सबमिशन | 29/04/2026 10:16 AM (6 महीनों पहले) |
|---|
| संयम | 26/05/2026 12:34 PM (27 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 365625 [sambitraj STUDENT-MANAGEMENT-SYSTEM तक 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 Dashboard अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|