| Title | dhikshitha29 Insurance-Management-System 125362cc21dca20d74091a4913a5096bb58dd837 Missing Authorization |
|---|
| Description | The affected components are `Insurance_Management_System/Admin/includes/AddNewPlan-inc.php` and `Insurance_Management_System/Admin/includes/changePlan-inc.php`, the backends of the plan management forms. Neither script performs any session or role check. `AddNewPlan-inc.php` inserts an attacker-supplied plan into the `Plan` table:
```php
if (isset($_POST['submit'])) {
require '../../database.php';
$Plan_no = $_POST['Plan_no'];
$Name = $_POST['Name'];
...
$sql = "INSERT INTO plan(Plan_no, Name, MMA, ...) VALUES (?,?,?,...)";
```
and `changePlan-inc.php` updates any existing plan in the same unauthenticated way:
```php
$sql = "UPDATE plan SET Name = ?, MMA = ?, ... WHERE Plan_no = ?";
```
Any unauthenticated remote user can create new insurance plans or overwrite the parameters (premiums, terms, sum-assured limits, age ranges) of existing plans, corrupting the business logic for all agencies and policy holders.
|
|---|
| Source | ⚠️ https://github.com/dhikshitha29/Insurance-Management-System/issues/5 |
|---|
| User | Huan Wu (UID 101973) |
|---|
| Submission | 10/07/2026 16:05 (28 days ago) |
|---|
| Moderation | 10/21/2026 08:54 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424680 [dhikshitha29 Insurance-Management-System Plan Management Form AddNewPlan-inc.php submit/Plan_no/Name missing authentication] |
|---|
| Points | 20 |
|---|