| Title | oretnom23 file-management-system-php 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 Missing Authentication |
|---|
| Description | The affected component is `ajax.php`, the single backend for all actions. Apart from `login`/`logout` no action performs any session check, and the record identifiers are taken directly from the request without ownership verification:
```php
function delete_folder(){
extract($_POST);
$delete = $this->db->query("DELETE FROM folders where id =".$id);
if($delete)
echo 1;
}
function delete_file(){
extract($_POST);
$path = $this->db->query("SELECT file_path from files where id=".$id)->fetch_array()['file_path'];
$delete = $this->db->query("DELETE FROM files where id =".$id);
if($delete){
unlink('assets/uploads/'.$path);
return 1;
}
}
```
Any unauthenticated remote user can delete arbitrary folders and files of any user (including the physical file on disk via `unlink`) and rename or modify records, simply by POSTing the numeric `id`.
|
|---|
| Source | ⚠️ https://github.com/oretnom23/file-management-system-php/issues/8 |
|---|
| User | Zeming Hu (UID 101971) |
|---|
| Submission | 10/07/2026 16:12 (14 days ago) |
|---|
| Moderation | 10/21/2026 08:55 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424692 [oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 AJAX ajax.php delete_folder id missing authentication] |
|---|
| Points | 20 |
|---|