| タイトル | PHPGurukul Online Course Registration v3.1 Missing Authorization |
|---|
| 説明 | A critical vulnerability has been found in PHP Gurukul Online Course Registration System v3.1 where the authorization mechanism fails to verify user roles before serving administrative content. The application only checks if a user is authenticated but does not verify their authorization level.
The vulnerability exists in the session management implementation. The login process (index.php) creates session variables but omits role assignment:
$_SESSION['login']=$_POST['regno'];
$_SESSION['id']=$num['studentRegno'];
$_SESSION['sname']=$num['studentName'];
// Missing: $_SESSION['role']=$num['role'];
Any authenticated student can access administrative functions by directly navigating to admin URLs (e.g., /onlinecourse/admin/user-log.php, /onlinecourse/admin/manage-users.php) without role verification. This allows privilege escalation from student to administrator.
An authenticated attacker with student privileges can gain complete administrative access, view and modify all user data, manage courses, escalate privileges, and compromise the entire system.
Related Vulnerability: This follows the same pattern as CVE-2025-15390 ( VDB-339151) affecting the CRM Application from the same vendor. Both products share identical vulnerable code patterns but are separate applications requiring independent fixes.
|
|---|
| ソース | ⚠️ https://github.com/rsecroot/Online-Course-Registration/blob/main/Broken%20Access%20Control.md |
|---|
| ユーザー | hackerfactory (UID 85869) |
|---|
| 送信 | 2025年12月31日 16:50 (10 月 ago) |
|---|
| モデレーション | 2026年01月01日 09:46 (17 hours later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 339326 [PHPGurukul Online Course Registration 迄 3.1 特権昇格] |
|---|
| ポイント | 20 |
|---|