| शीर्षक | kishor-23 food-waste-management-system b3a70b2c492dc9904de5be1ad9389bd79b87f82c Authorization Bypass |
|---|
| विवरण | All three roles (donor, admin, delivery) store their identity in the same `$_SESSION['name']` key, and the admin pages enforce access with only `if($_SESSION['name']==''){ header("location:signin.php"); }` (e.g. `admin/admin.php:7-9`, `admin/donate.php:7-9`, `admin/feedback.php:7-9`, `admin/analytics.php:7-9`). No role attribute is ever checked. Therefore any self-registered donor can log in through the public `signup.php` flow and operate the entire admin module: the dashboard (`admin/admin.php`), donation filter (`admin/donate.php`), all user feedback with PII (`admin/feedback.php`), analytics, and the order-assignment actions. Combined with CVE-04 and CVE-17 this grants anonymous-to-database compromise in two steps. |
|---|
| स्रोत | ⚠️ https://github.com/kishor-23/food-waste-management-system/issues/11 |
|---|
| उपयोगकर्ता | xbjds (UID 101126) |
|---|
| सबमिशन | 09/09/2026 04:05 PM (25 दिन पहले) |
|---|
| संयम | 04/10/2026 10:15 AM (25 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413403 [kishor-23 food-waste-management-system Role Attribute admin/admin.php name अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|