| शीर्षक | kishor-23 food-waste-management-system b3a70b2c492dc9904de5be1ad9389bd79b87f82c Execution After Redirect |
|---|
| विवरण | Every protected page in the `admin/` and `delivery/` directories authenticates with the pattern `if($_SESSION['name']==''){ header("location:..."); }` and never calls `exit()` or `die()` (e.g. `admin/feedback.php:7-9`, `admin/admin.php:7-9`, `admin/donate.php:7-9`, `delivery/delivery.php:7-9`, `delivery/deliverymyord.php:8-10`). PHP continues executing the rest of the script after the redirect, so anonymous visitors receive the full page body and can trigger the POST handlers. Verified effects with a cookie-less client: `admin/feedback.php` returns HTTP 302 while the body still dumps every feedback row (names/emails/messages); `admin/admin.php` still renders usage totals; POST handlers in `admin/admin.php` and `delivery/delivery.php` execute their UPDATE statements. This flaw underpins the anonymous exploitability of CVE-02/CVE-03/CVE-04/CVE-05/CVE-06. |
|---|
| स्रोत | ⚠️ https://github.com/kishor-23/food-waste-management-system/issues/12 |
|---|
| उपयोगकर्ता | xbjds (UID 101126) |
|---|
| सबमिशन | 09/09/2026 04:05 PM (25 दिन पहले) |
|---|
| संयम | 04/10/2026 10:15 AM (25 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 257056 [kishor-23 Food Waste Management System 1.0 /admin/admin.php अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|