| 제목 | AdithyaYelloju Restaurant-Management-System 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Unverified Password Change |
|---|
| 설명 | The affected component is `User/forgot3.php`. The script takes `email` and `password` POST parameters and runs an `UPDATE user SET password='...' WHERE email='...'` against any email that the attacker provides. There is no session check, no requirement that the request came from `forgot2.php` (which only filters by matching `fname` and `phone` but is also unauthenticated — see CVE-13/14), no email verification, no token, and no CAPTCHA. Concretely, anyone reaching the site can submit:
```
[email protected]&password=any-12-chars-pass
```
and reset that user's password without any further verification. `mysqli_real_escape_string` only sanitizes for SQL; the script happily updates the row. |
|---|
| 원천 | ⚠️ https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/12 |
|---|
| 사용자 | 100001001X (UID 100909) |
|---|
| 제출 | 2026. 09. 01. PM 01:39 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 12. AM 11:39 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416872 [AdithyaYelloju Restaurant-Management-System 까지 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Password Reset User/forgot3.php email/password SQL 주입] |
|---|
| 포인트들 | 20 |
|---|