| शीर्षक | code-projects Barangay Resident Profiling Management System (BRPMS) / Barangay San Fabian 1.0 Insecure Direct Object Reference (IDOR) |
|---|
| विवरण | An authenticated IDOR vulnerability exists in the boarder management module of BRPMS.
The endpoint accepts a user-controlled id value and directly applies read, update, archive, restore, and permanent delete operations to the corresponding boarders row. The code checks only whether the user is logged in via check_login(), but it does not verify whether the current user is authorized to manage the selected object or whether the action should require a higher-privilege account.
Examples:
$id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
DELETE FROM boarders WHERE id = ?
UPDATE boarders SET is_archived = 1, date_archived = NOW() WHERE id = ?
Relevant code:
boarders.php, lines 4, 7, 43, 104, 119, 135, and 164
|
|---|
| स्रोत | ⚠️ https://gist.github.com/c4ttr4ck/3601aa0ba9e567705823b6d425e84237 |
|---|
| उपयोगकर्ता | c4ttr4ck (UID 75518) |
|---|
| सबमिशन | 07/07/2026 10:28 PM (2 महीनों पहले) |
|---|
| संयम | 23/08/2026 08:08 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394527 [code-projects Barangay Resident Profiling Management System 1.0 Boarder Management /boarders.php पहचान अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|