| Titolo | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d Exposure of Private Personal Information to an Unauthorized Acto |
|---|
| Descrizione | The affected component is `delivery/checkfarmer.json.php`, the AJAX endpoint used by the delivery form to look up a farmer. Unlike every other page, it only includes the database connection file and **does not include `incl/header.incl.php`**, which is where the session/authentication check lives. The endpoint takes `$_POST['fname']` (a farmer number) and returns the matching farmer's personal data:
```php
include_once '../incl/conn.incl.php';
$fname=$_POST['fname'];
$fqry= mysqli_query($conn,"select * from farmers where f_no='". mysqli_real_escape_string($conn, $fname) ."'") ...
?>
<span class='input-xlarge uneditable-input' ><?php echo $farmer['f_name']; ?></span>
...
<span class="input-xlarge uneditable-input" ...><?php echo $farmer['f_locallity']; ?></span>
<span class="input-xlarge uneditable-input" ><?php echo $farmer['f_ac']; ?> </span>
<span class="input-xlarge uneditable-input" ><?php echo $farmer['f_phone'] ?> </span>
```
An unauthenticated attacker can enumerate farmer numbers (`f_no` values are sequential) and harvest the full name, locality, **bank account number** (`f_ac`), and **phone number** (`f_phone`) of every registered farmer without logging in. This discloses sensitive personal and financial information of third parties. |
|---|
| Fonte | ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/5 |
|---|
| Utente | Elymas (UID 98074) |
|---|
| Sottomissione | 02/10/2026 14:33 (25 giorni fa) |
|---|
| Moderazione | 18/10/2026 18:26 (16 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 421856 [Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php fname rivelazione di informazioni] |
|---|
| Punti | 20 |
|---|