| Название | Object deletion |
|---|
| Описание | A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects on how the functions contained in ajax.php file will work with their parameters. When the expected parameter and fuctions are passed in POST parameters it expects an ID argument.
It's possible to delete and create objects without validation, which leads to Ar an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-306.
function delete_category(){
extract($_POST);
$delete = $this->db->query("DELETE FROM category_list where id = ".$id);
if($delete)
return 1;
Are one of the vulnerable functions when abused could arbitrary delete informations from the web application.
admin_class.php contains the instructions of which function and how it works, and notices all of them are vulnerable to manipulation of the application resources without authorization handling.
|
|---|
| Источник | ⚠️ https://cwe.mitre.org/data/definitions/306.html |
|---|
| Пользователь | Qnsx (UID 41280) |
|---|
| Представление | 17.02.2023 20:00 (4 лет назад) |
|---|
| Модерация | 18.02.2023 08:41 (13 hours later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 221455 [SourceCodester Online Pizza Ordering System 1.0 POST Parameter ajax.php delete_category слабая аутентификация] |
|---|
| Баллы | 17 |
|---|