| शीर्षक | jairiidriss restaurant-website-php-mysql 1.0 jairiidriss Restaurant Website PHP MySQL 1.0 missing authenticat |
|---|
| विवरण | Restaurant Website PHP MySQL v1.0 contains a missing authentication vulnerability in multiple administrative AJAX endpoints under /admin/ajax_files/.
The affected files perform sensitive administrative actions such as deleting menus, modifying order states, managing menu categories, and uploading gallery images without validating administrator sessions.
While the main administrative pages correctly enforce session-based authentication, the corresponding AJAX handlers contain no authentication or authorization checks and directly process attacker-controlled POST requests.
A remote unauthenticated attacker can directly invoke these endpoints to perform unauthorized administrative operations. |
|---|
| स्रोत | ⚠️ https://github.com/jairiidriss/restaurant-website-php-mysql/issues/6 |
|---|
| उपयोगकर्ता | Fklov (UID 98102) |
|---|
| सबमिशन | 01/06/2026 07:07 PM (5 महीनों पहले) |
|---|
| संयम | 03/07/2026 06:55 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 376138 [jairiidriss restaurant-website-php-mysql तक 521428b5b612449df0cf4a5d15ee40cba67f3d35 AJAX Endpoint /admin/ajax_files कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|