| शीर्षक | Soarkey StudentManagement e08f7f1d5015af407aa4cca0ada3dea189b4937e Use of Client-Side Authentication |
|---|
| विवरण | The affected registration workflow spans `code/WebContent/register.html`, `code/src/service/RegisterServlet.java`, and `code/src/dao/UserDao.java`. `register.html` exposes a client-controlled `level` radio option with both `用户` and `管理员`. `RegisterServlet.doPost()` at lines 19-40 reads `level` directly from the request, passes it to `UserDao.register(username, password, level)`, and then places the new account into the `admin` session branch whenever the submitted value is not `用户`. `UserDao.register()` at lines 71-86 stores the supplied role directly in the `user` table. An unauthenticated attacker can self-register as an administrator and immediately obtain the administrative interface.
|
|---|
| स्रोत | ⚠️ https://github.com/Soarkey/StudentManagement/issues/35 |
|---|
| उपयोगकर्ता | Jacinta (UID 99758) |
|---|
| सबमिशन | 08/08/2026 01:07 PM (1 महीना पहले) |
|---|
| संयम | 13/09/2026 03:03 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403293 [Soarkey StudentManagement तक e08f7f1d5015af407aa4cca0ada3dea189b4937e Registration Workflow register.html RegisterServlet.doPost level अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|