| タイトル | SourceCodester Client Database Management System (CDMS) 1.0 Improper Authorization |
|---|
| 説明 | Client Database Management System 1.0 contains an access control vulnerability in the endpoint /superadmin_delete_manager.php.
The script processes POST requests containing a manager_id parameter and directly executes the deletion operation without validating authentication state or verifying user privileges.
The endpoint does not enforce session checks and does not confirm that the requester has superadmin permissions before performing the delete action.
As a result, an unauthenticated attacker can send a crafted HTTP POST request to delete arbitrary sales manager accounts.
Proof of Concept
curl -X POST http://TARGET/cdm/superadmin_delete_manager.php \
-d "manager_id=3"
Server Response
{"status":"success","message":"Manager deleted successfully."}
The operation succeeds without any authentication token or valid session.
Impact
An attacker can:
Delete arbitrary sales managers
Disrupt business workflows
Compromise data integrity
Bypass privilege restrictions
Potentially affect associated records (sales agents, reports, assignments)
This vulnerability represents a critical failure in access control enforcement.
CVSS v3.1 Vector
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
|---|
| ソース | ⚠️ https://gist.github.com/Adarshh-A/1aae387a3cf4ea05c871ddafc64d0348 |
|---|
| ユーザー | Adarsh007 (UID 95657) |
|---|
| 送信 | 2026年02月26日 10:17 (7 月 ago) |
|---|
| モデレーション | 2026年03月07日 21:42 (9 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 349740 [SourceCodester Client Database Management System 1.0/3.1 Endpoint superadmin_delete_manager.php manager_id 特権昇格] |
|---|
| ポイント | 20 |
|---|