| Título | satya-vinay Events-Management-System 437c77ceb69bf9fe2e3f4f46f7871b83f425383a Missing Authentication |
|---|
| Descrição | The affected components are all pages in the site root: `index.php`, `submit.php`, `edit.php`, `doedit.php`, `delete.php`, `dodelete.php`, `search.php`, `fetch.php`, `report.php`, `createpdf.php`. The application contains no login page, no session handling, and no authorization check whatsoever — administrative functions (viewing every registrant's personal data, editing any record, deleting any record) are exposed directly to the internet. Verified: every page returns HTTP 200 to an unauthenticated client, a request to `/login.php` returns 404 (no login mechanism exists), and anonymous POSTs to `submit.php`, `doedit.php`, and `dodelete.php` all execute their database operations.
|
|---|
| Fonte | ⚠️ https://github.com/satya-vinay/Events-Management-System/issues/4 |
|---|
| Utilizador | xbjds (UID 101126) |
|---|
| Submissão | 04/10/2026 17h47 (há 22 dias) |
|---|
| Moderação | 19/10/2026 07h23 (15 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 422248 [satya-vinay Events-Management-System até 437c77ceb69bf9fe2e3f4f46f7871b83f425383a Autenticação fraca] |
|---|
| Pontos | 20 |
|---|