| 제목 | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 Missing Authentication |
|---|
| 설명 | The affected components are the state-changing endpoints in the repository root and in `admin/` that include only the database connection and never `session.php`:
```php
// remove_announcements.php (root)
<?php include('admin/dbcon.php'); ?>
<?php
$id = $_POST['id'];
mysql_query("delete from teacher_class_announcements where teacher_class_announcements_id = '$id'")or die(mysql_error());
?>
```
```php
// admin/de_activate.php
<?php
include('dbcon.php');
$get_id = $_GET['id'];
mysql_query("update teacher set teacher_stat = 'Deactivated' where teacher_id = '$get_id'");
header('location:teachers.php');
?>
```
```php
// admin/delete_student.php
<?php
include('dbcon.php');
if (isset($_POST['delete_student'])){
$id=$_POST['selector'];
...
mysql_query("DELETE FROM student where student_id='$id[$i]'");
```
Affected endpoints include `remove_announcements.php`, `remove_student.php`, `delete_file.php`, `delete_class.php`, `delete_class_event.php` (root) and `admin/de_activate.php`, `admin/delete_student.php`, `admin/delete_teacher.php`, `admin/delete_users.php`, `admin/delete_class.php`, `admin/delete_department.php`, `admin/delete_subject.php`, `admin/delete_sy.php`, `admin/delete_event.php`, `admin/save_student.php` (admin). Every one of them accepts its target identifier from `$_POST`/`$_GET` and concatenates it into a DELETE/UPDATE/INSERT statement. An anonymous attacker can therefore delete or deactivate arbitrary database rows — including whole tables by injecting `1 OR 1=1` into the id — without any session cookie, and `admin/student_table.php` / `student_table_reg.php` / `student_table_unreg.php` serve the full student list (names and usernames) to anonymous users as well. There is no CSRF token anywhere in the application, so these operations can also be triggered from a third-party page through a logged-in victim's browser.
|
|---|
| 원천 | ⚠️ https://github.com/KusalkaSilva/Learning-Management-System/issues/5 |
|---|
| 사용자 | vuldb2026 (UID 101467) |
|---|
| 제출 | 2026. 09. 22. PM 05:45 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. PM 07:30 (19 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416734 [KusalkaSilva Learning-Management-System 까지 ffeb873f8803f1e9664384ff75000c7da45466d2 State-Changing Endpoints remove_announcements.php mysql_query id 약한 인증] |
|---|
| 포인트들 | 20 |
|---|