| Título | girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Missing Authorization |
|---|
| Descrição | The affected components are the admin display pages such as `Admin/showdoctor.php`, `Admin/showclinic.php`, `Admin/showmanager.php`, and `Admin/showdoctorschedule.php`. These pages query and print data without any session or role check:
```php
<?php
require_once("dbconfig.php");
$result = $conn->query("SELECT * FROM doctor");
// ... echo total count and all rows
?>
```
An unauthenticated attacker can directly request these URLs and read the complete doctor, clinic, and manager records. |
|---|
| Fonte | ⚠️ https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/14 |
|---|
| Utilizador | a86402175 (UID 101298) |
|---|
| Submissão | 16/09/2026 15h53 (há 28 dias) |
|---|
| Moderação | 12/10/2026 21h04 (26 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 417188 [girishsaraf Online-Appointment-Booking-System até f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Admin Display Pages Admin/showdoctor.php Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|