| Title | dhikshitha29 Insurance-Management-System 125362cc21dca20d74091a4913a5096bb58dd837 Missing Authorization |
|---|
| Description | The affected component is `Insurance_Management_System/Admin/includes/Admin-Register-inc.php`, the backend of the "Add New Admin" form. The script performs no session or role check at all; it only requires the POST fields to be non-empty and then inserts the attacker-supplied values into the `Admin` table:
```php
if (isset($_POST['submit'])) {
require '../../database.php';
$Admin_id = $_POST['Admin_id'];
$password = $_POST['password'];
...
$sql = "INSERT INTO admin(Admin_id, Branch_id, Name, Mobile_no, Email_id, DOB, Designation, City, Password) VALUES (?,?,?,?,?,?,?,?,?)";
```
Any unauthenticated remote user can register themselves as an administrator with an arbitrary password, log in through `Admin-Login-inc.php`, and obtain full control over the application: viewing all policies, registering agents, and modifying insurance plans.
|
|---|
| Source | ⚠️ https://github.com/dhikshitha29/Insurance-Management-System/issues/4 |
|---|
| User | TypeThe0ry (UID 101969) |
|---|
| Submission | 10/07/2026 16:01 (14 days ago) |
|---|
| Moderation | 10/21/2026 08:54 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424679 [dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php submit/Admin_id/password improper authorization] |
|---|
| Points | 20 |
|---|