| 제목 | AdithyaYelloju Restaurant-Management-System 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Missing Authentication |
|---|
| 설명 | The affected components are `admin/delete1.php`, `admin/delete1_m.php`, `admin/delete_user1.php`, `admin/approve.php`, `admin/notapprove.php`, `admin/approvet.php`, `admin/notapprovet.php`, `User/cancel.php`, and `User/cancel_t.php`. Each of these endpoints performs a destructive state change (mass DELETE/UPDATE) in response to a single GET request and **performs no authentication at all** — `session_start()` is not even called. Every endpoint takes a `?id=` value from the URL and uses it verbatim in a `DELETE FROM ...` or `UPDATE ... SET status=...` SQL statement, both unauthenticated and (per CVE-04) exploitable for SQL injection. A complete stranger with a single `curl` invocation can delete every menu row, every table row, every user row, every order row, or flip every order's status from `no` to `yes`/`Approved`/`Cancel`. There is no CSRF token, no role check, and no per-row ownership validation. |
|---|
| 원천 | ⚠️ https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/10 |
|---|
| 사용자 | 100001001X (UID 100909) |
|---|
| 제출 | 2026. 09. 01. PM 01:38 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 12. AM 11:39 (1 month later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 411927 [AdithyaYelloju Restaurant-Management-System 까지 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Admin Area /admin/ id 권한 상승] |
|---|
| 포인트들 | 0 |
|---|