| Title | oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635 Missing Authentication |
|---|
| Description | The affected component is `admin/session.php`, which is included at the top of `admin/header.php` and therefore runs on every admin page:
```php
<?php
if (session_status() === PHP_SESSION_NONE)
session_start();
$user=$_SESSION['user_id'];
if(!$_SESSION['user_id'])
{
header('location:login.php');
}
?>
```
The authentication check only sends a `Location: login.php` header and never calls `exit`/`die`, so PHP continues executing the rest of the protected page. Any unauthenticated visitor can access all admin functionality (customer/employee/payment/ticket/document/salary data, reports, admin management) without a valid session; the browser would only see the redirect if the response body were discarded, but curl or any tool that reads the body receives the fully rendered administrative page. `admin/delete.php` does not even include `session.php` and has no authentication check at all. This flaw is the root cause that makes every other vulnerability in this application (SQL injection, unrestricted upload, admin creation, password reset, stored XSS sinks) exploitable by anonymous users.
|
|---|
| Source | ⚠️ https://github.com/oretnom23/php-travel-agency-system/issues/2 |
|---|
| User | zeroxf (UID 101992) |
|---|
| Submission | 10/08/2026 16:37 (24 days ago) |
|---|
| Moderation | 10/21/2026 16:10 (13 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 424811 [oretnom23 php-travel-agency-system Session admin/session.php user_id missing authentication] |
|---|
| Points | 20 |
|---|