| Título | dhikshitha29 Insurance-Management-System 125362cc21dca20d74091a4913a5096bb58dd837 Missing Authorization |
|---|
| Descrição | The affected component is `Insurance_Management_System/Admin/includes/Admin-Register-inc.php`, the backend of the "Add New Admin" form. The script performs no session or role check at all; it only requires the POST fields to be non-empty and then inserts the attacker-supplied values into the `Admin` table:
```php
if (isset($_POST['submit'])) {
require '../../database.php';
$Admin_id = $_POST['Admin_id'];
$password = $_POST['password'];
...
$sql = "INSERT INTO admin(Admin_id, Branch_id, Name, Mobile_no, Email_id, DOB, Designation, City, Password) VALUES (?,?,?,?,?,?,?,?,?)";
```
Any unauthenticated remote user can register themselves as an administrator with an arbitrary password, log in through `Admin-Login-inc.php`, and obtain full control over the application: viewing all policies, registering agents, and modifying insurance plans.
|
|---|
| Fonte | ⚠️ https://github.com/dhikshitha29/Insurance-Management-System/issues/4 |
|---|
| Utilizador | TypeThe0ry (UID 101969) |
|---|
| Submissão | 07/10/2026 16h01 (há 14 dias) |
|---|
| Moderação | 21/10/2026 08h54 (14 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 424679 [dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php submit/Admin_id/password Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|