| Titolo | AdithyaYelloju Restaurant-Management-System 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Authorization Bypass Through User-Controlled SQL Primary Key |
|---|
| Descrizione | The affected components are the pages under `admin/` (`user_list.php`, `add_menu.php`, `add_table.php`, `display_menu.php`, `tables.php`, `orders.php`, `t_orders.php`, `accepted_list.php`, `table_booking.php`, `profile.php`, `index.php`, `logout.php`, etc.). Every page only guards access with a check that any session variable named `user` exists:
```php
// admin/user_list.php
include 'connection.php';
$result=mysqli_query($conn,"select * from user");
while ($row = mysqli_fetch_array($result)) { ... }
// admin/add_menu.php
session_start();
if(isset($_SESSION['user']))
{
if(isset($_POST["submit"]))
{
mysqli_query($conn,"insert into menu values(...$_POST[item]...)");
}
}
```
There is no check that the session belongs to an *administrator* (the `admin` table); no role-based access control; no comparison against `$_SESSION['id']`; no token bound to the row being modified; and entire pages (`user_list.php`, `profile.php`, `orders.php`, `t_orders.php`, `accepted_list.php`) do not even call `session_start()` so they execute for any anonymous visitor. Combined with CVE-14, any registered ordinary user (or even a freshly self-registered account) has the same power as the super-admin: she can create menu items, create tables, browse the full user list with hashed-style information, and place/cancel/approve orders.
The same flaw lets attacker-controlled identifiers (`?id=`) drive destructive actions without ownership checks (see CVE-20 IDOR) — the SQL primary key is supplied by the request, accepted by the server, and used without any per-row authorization. This matches the CWE definition of "Authorization Bypass Through User-Controlled SQL Primary Key" exactly.
|
|---|
| Fonte | ⚠️ https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/9 |
|---|
| Utente | 100001001X (UID 100909) |
|---|
| Sottomissione | 01/09/2026 13:37 (29 giorni fa) |
|---|
| Moderazione | 30/09/2026 10:09 (29 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 411927 [AdithyaYelloju Restaurant-Management-System fino a 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Admin Area /admin/ id escalationi di privilegi] |
|---|
| Punti | 20 |
|---|