| タイトル | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d Exposure of Private Personal Information to an Unauthorized Acto |
|---|
| 説明 | The affected component is `delivery/checkfarmer.json.php`, the AJAX endpoint used by the delivery form to look up a farmer. Unlike every other page, it only includes the database connection file and **does not include `incl/header.incl.php`**, which is where the session/authentication check lives. The endpoint takes `$_POST['fname']` (a farmer number) and returns the matching farmer's personal data:
```php
include_once '../incl/conn.incl.php';
$fname=$_POST['fname'];
$fqry= mysqli_query($conn,"select * from farmers where f_no='". mysqli_real_escape_string($conn, $fname) ."'") ...
?>
<span class='input-xlarge uneditable-input' ><?php echo $farmer['f_name']; ?></span>
...
<span class="input-xlarge uneditable-input" ...><?php echo $farmer['f_locallity']; ?></span>
<span class="input-xlarge uneditable-input" ><?php echo $farmer['f_ac']; ?> </span>
<span class="input-xlarge uneditable-input" ><?php echo $farmer['f_phone'] ?> </span>
```
An unauthenticated attacker can enumerate farmer numbers (`f_no` values are sequential) and harvest the full name, locality, **bank account number** (`f_ac`), and **phone number** (`f_phone`) of every registered farmer without logging in. This discloses sensitive personal and financial information of third parties. |
|---|
| ソース | ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/5 |
|---|
| ユーザー | Elymas (UID 98074) |
|---|
| 送信 | 2026年10月02日 14:33 (17 日 ago) |
|---|
| モデレーション | 2026年10月18日 18:26 (16 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 421856 [Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php fname 情報漏えい] |
|---|
| ポイント | 20 |
|---|