| Title | satya-vinay Events-Management-System 437c77ceb69bf9fe2e3f4f46f7871b83f425383a Missing Authentication |
|---|
| Description | The affected components are all pages in the site root: `index.php`, `submit.php`, `edit.php`, `doedit.php`, `delete.php`, `dodelete.php`, `search.php`, `fetch.php`, `report.php`, `createpdf.php`. The application contains no login page, no session handling, and no authorization check whatsoever — administrative functions (viewing every registrant's personal data, editing any record, deleting any record) are exposed directly to the internet. Verified: every page returns HTTP 200 to an unauthenticated client, a request to `/login.php` returns 404 (no login mechanism exists), and anonymous POSTs to `submit.php`, `doedit.php`, and `dodelete.php` all execute their database operations.
|
|---|
| Source | ⚠️ https://github.com/satya-vinay/Events-Management-System/issues/4 |
|---|
| User | xbjds (UID 101126) |
|---|
| Submission | 10/04/2026 17:47 (21 days ago) |
|---|
| Moderation | 10/19/2026 07:23 (15 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422248 [satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a missing authentication] |
|---|
| Points | 20 |
|---|