| शीर्षक | Mstfakts College-Management-System 82ab01d057d96c8893c419cd9cb6870120faaea3 Improper Authentication |
|---|
| विवरण | The affected registration and login logic is in `Front-end/login.php:50-84` and `Front-end/server.php:6-35,84-122`. Public registration accepts an arbitrary email address and account type, checks only for an existing row in `visitor`, and immediately creates a password-controlled visitor account. The application then authenticates the account by email and uses `$_SESSION['email']` to resolve records in the separate `student` and `lecturer` identity tables. The supplied database seed at `Back-End (SQL-tables)/mebis.sql:194-198` contains pre-provisioned student identities, including `[email protected]`, that are absent from `visitor` at lines 342-345. An attacker can therefore register that email, choose a password, log in, and cause `Front-end/profile.php:47-101` and `Front-end/student.php:72-176` to load the pre-provisioned student's personal, academic, and enrollment data. The same session can invoke `Front-end/server.php:132-194` to alter that student's club membership.
|
|---|
| स्रोत | ⚠️ https://github.com/Mstfakts/College-Management-System/issues/6 |
|---|
| उपयोगकर्ता | Yangqiangfeng (UID 98164) |
|---|
| सबमिशन | 20/07/2026 11:04 AM (2 महीनों पहले) |
|---|
| संयम | 05/09/2026 08:59 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 399350 [Mstfakts College-Management-System Front-end/login.php email कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|