| タイトル | Object deletion |
|---|
| 説明 | A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects on how the functions contained in ajax.php file will work with their parameters. When the expected parameter and fuctions are passed in POST parameters it expects an ID argument.
It's possible to delete and create objects without validation, which leads to Ar an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-306.
function delete_category(){
extract($_POST);
$delete = $this->db->query("DELETE FROM category_list where id = ".$id);
if($delete)
return 1;
Are one of the vulnerable functions when abused could arbitrary delete informations from the web application.
admin_class.php contains the instructions of which function and how it works, and notices all of them are vulnerable to manipulation of the application resources without authorization handling.
|
|---|
| ソース | ⚠️ https://cwe.mitre.org/data/definitions/306.html |
|---|
| ユーザー | Qnsx (UID 41280) |
|---|
| 送信 | 2023年02月17日 20:00 (4 年 ago) |
|---|
| モデレーション | 2023年02月18日 08:41 (13 hours later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 221455 [SourceCodester Online Pizza Ordering System 1.0 POST Parameter ajax.php delete_category 弱い認証] |
|---|
| ポイント | 17 |
|---|