| タイトル | SourceCodester Online Food Ordering System in PHP and MySQL Source Code 1.0 Missing Authentication on Admin Delete Endpoints |
|---|
| 説明 | SourceCodester Online Food Ordering System in PHP and MySQL Source Code
Missing Authentication on Admin Delete Endpoints
VENDOR
SourceCodester
PRODUCT
Online Food Ordering System in PHP and MySQL Source Code
Product URL: https://www.sourcecodester.com/php/18232/food-order-system.html
VULNERABILITY
The admin/delete_admin.php endpoint performs a sensitive deletion without first requiring an authenticated admin session (CWE-306).
Discovered by: Shailendra Mourya (CyberShailendra)
Affected files: admin/delete_admin.php; similar missing checks are reported in admin/delete.php and admin/delete_category.php
Report date: 2026-10-10
Status: Reported as reproduced on a local XAMPP test instance.
FINDING DETAILS
Title: Online Food Ordering System delete_admin.php Missing Authentication Check
Affected file: admin/delete_admin.php (same pattern in admin/delete.php and admin/delete_category.php)
Vulnerability type: Missing Authentication for Critical Function (CWE-306)
Attack vector: Network (remote)
Authentication required: None
CVSS 3.1 vector (estimated): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1 score (estimated): 8.6 (High)
Root cause: The script includes config/constants.php for the database connection but does not include user_logged.php or check $_SESSION['user'] before executing the delete query.
Proof of concept: Unauthenticated GET /web/admin/delete_admin.php?id=50
Observed impact: The admin record with id=50 was reportedly deleted without a login session, preventing that account from logging in.
Confirmed by: Local XAMPP test instance, 2026-10-10.
Remediation: Require authentication at the top of all admin action scripts before database operations. Add exit() after redirecting unauthenticated users in user_logged.php.
TECHNICAL DETAILS — VULNERABLE CODE (admin/delete_admin.php)
<?php
include('../config/constants.php'); // database connection only; no authentication check
if(isset($_GET['id'])){
$id = intval($_GET['id']);
$sql = "delete from tbl_admin where id=$id";
$res = mysqli_query($conn, $sql);
...
}
?>
The endpoint neither includes user_logged.php nor checks $_SESSION['user'] before running the delete query. As written, it does not distinguish an authenticated admin from an unauthenticated visitor.
CONTRIBUTING ISSUE — admin/partials/user_logged.php
The following guard redirects but does not stop execution:
<?php
if(!isset($_SESSION['user'])){
$_SESSION['not-logged-in'] = "please login";
header("Location:" . SITEURL. 'admin/login.php');
// Missing exit(); execution continues in the including page.
}
?>
REMEDIATION CODE — admin/delete_admin.php
<?php
include('../config/constants.php');
include('user_logged.php');
if(isset($_GET['id'])){
$id = intval($_GET['id']);
$sql = "delete from tbl_admin where id=?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "i", $id);
$res = mysqli_stmt_execute($stmt);
if($res){
$_SESSION['delete_admin'] = "admin deleted successfully";
}
header('Location:'.SITEURL.'admin/admin.php');
exit();
}
?>
REMEDIATION CODE — admin/partials/user_logged.php
<?php
if(!isset($_SESSION['user'])){
$_SESSION['not-logged-in'] = "please login";
header("Location:" . SITEURL. 'admin/login.php');
exit();
}
?>
|
|---|
| ソース | ⚠️ https://github.com/CyberShailendra/SourceCodesterAuthenticationonAdminDeleteEndpoints |
|---|
| ユーザー | CyberShailendra (UID 99999) |
|---|
| 送信 | 2026年10月10日 10:44 (17 日 ago) |
|---|
| モデレーション | 2026年10月26日 17:02 (16 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 426510 [SourceCodester Online Food Ordering System 1.0 admin/delete_admin.php id 弱い認証] |
|---|
| ポイント | 20 |
|---|