| Título | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Missing Authentication for Critical Function |
|---|
| Descrição | Unauthenticated administrator account (re)creation in create_admin.php of SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows remote attackers to recreate the admin account with the publicly documented default password admin/admin123 at any time, defeating password rotation, and additionally discloses raw PDO error messages to anonymous visitors.
The bootstrap script performs DDL (CREATE TABLE IF NOT EXISTS users, line 7) and inserts the hard-coded admin/admin123 credentials (lines 14-20) on every unauthenticated GET. The catch branch echoes the raw PDO exception message (line 24), leaking schema and constraint details.
CWE-306. CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N = 9.1.
Verified on a local deployment (PHP 7.3.4 / MySQL 5.7.26, 2026-10-17):
- GET /create_admin.php (no cookie) -> 200, provisioning executed
- Repeat GET -> "User already exists or Error: SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry 'admin' for key 'username'" (raw SQL error disclosed)
Impact: an attacker can (re)create the administrator account with the well-known default credentials after any password change, regaining admin access; the error output aids further attacks.
Remediation: remove create_admin.php from the web root after installation (or self-delete after first run); require an authenticated admin session; never echo $e->getMessage() to the client.
PoC:
curl -s "http://<TARGET>/create_admin.php"
White-box audit by EVA Security Research (yuechuya), 2026-10-17. Full 12-section report, source SHA-256 manifest and three-pass review:
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-02-Unauthenticated-Admin-Creation.md |
|---|
| Fonte | ⚠️ https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-02-Unauthenticated-Admin-Creation.md |
|---|
| Utilizador | yuechuya (UID 101209) |
|---|
| Submissão | 18/10/2026 10h41 (há 22 dias) |
|---|
| Moderação | 09/11/2026 17h56 (22 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 433179 [SourceCodester Smart Attendance System with QR Code Scanner 1.0 Admin Account Creation create_admin.php getMessage Autenticação fraca] |
|---|
| Pontos | 20 |
|---|