| शीर्षक | a4m4 Student-Management-System--PHP- 1.0 Authentication Bypass |
|---|
| विवरण | The access control mechanism at the top of almost every file in the `admin/` directory is insufficiently implemented. It checks for a valid session but, after sending a redirect header, fails to terminate script execution:
```php
session_start();
if(isset($_SESSION['uid'])){
echo "";
} else {
header('location: ../login.php');
}
```
Because there is no exit; or die; statement after the header() call, PHP continues to execute the rest of the script, rendering the full protected page (HTML, forms, sensitive data) and sending it to the client along with the 302 redirect. An attacker can simply ignore the redirect instruction and read the response body, thereby gaining unauthorised access to all administrative functionality. |
|---|
| स्रोत | ⚠️ https://github.com/a4m4/Student-Management-System--PHP-/issues/2 |
|---|
| उपयोगकर्ता | gscsd (UID 97914) |
|---|
| सबमिशन | 11/05/2026 05:59 AM (5 महीनों पहले) |
|---|
| संयम | 31/05/2026 04:16 PM (20 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 367550 [a4m4 Student-Management-System तक f0c5f6842c5e8c431ff02b5260a565ca844df3a0 Admin Endpoint admin/ uid Redirect] |
|---|
| अंक | 20 |
|---|