| Título | SourceCodester Smart Attendance System with QR Code Scanner 1.0 Missing Authentication for Critical Function |
|---|
| Descrição | Missing authentication in the JSON endpoint api/attendance_handler.php of SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows remote attackers to forge attendance records (IN/OUT, Present/Late) for any student code without any session, and to enumerate valid student codes and names via the response oracle.
The kiosk UI page (scan_attendance.php) includes includes/auth.php, but the API behind it includes only includes/db.php (line 4) - the classic page-gated, API-open pattern. Any POST body with student_code is trusted and inserted into attendance_logs (lines 110-111); the response echoes the student's full_name.
CWE-306. CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5.
Verified on a local deployment (PHP 7.3.4 / MySQL 5.7.26, 2026-10-17), with NO cookie/session:
- POST /api/attendance_handler.php student_code=XTEST-001 -> {"status":"success","message":"In: Audit Test (LATE)","student":"...","time":"07:18 PM"}
- DB: attendance_logs row id=2 created (student_code=XTEST-001, type=IN, status=Late)
- Unknown code -> {"status":"error","message":"Student not registered!"} (existence oracle)
Impact: integrity of the entire attendance dataset can be destroyed at scale (mass forging of Present/Late records for any student); the response oracle enables unauthenticated enumeration of student codes and personal names.
Remediation: require includes/auth.php in the API (same gate as the UI); restrict the kiosk use-case with a per-kiosk token and rate limit; return generic errors without student names.
PoC:
curl -s -X POST "http://<TARGET>/api/attendance_handler.php" --data "student_code=STU-2024-001"
White-box audit by EVA Security Research (yuechuya), 2026-10-17. Full 12-section report, source SHA-256 manifest and three-pass review:
https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-03-Unauthenticated-Attendance-Write.md |
|---|
| Fonte | ⚠️ https://github.com/yuechuya/sourcecodester-vuln-reports/blob/main/reports/VULN-03-Unauthenticated-Attendance-Write.md |
|---|
| Utilizador | yuechuya (UID 101209) |
|---|
| Submissão | 18/10/2026 10h41 (há 22 dias) |
|---|
| Moderação | 09/11/2026 17h57 (22 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 433180 [SourceCodester Smart Attendance System with QR Code Scanner 1.0 JSON Endpoint attendance_handler.php student_code Autenticação fraca] |
|---|
| Pontos | 20 |
|---|