| Title | girishsaraf Online-Appointment-Booking-System f427b4757128ca253d33d0cc4e87bbb9c999a4d5 Missing Authorization |
|---|
| Description | The affected component is the root `changebookingstatus.php` `submit2` handler. It updates appointment statuses based solely on POST parameters without any session or role check:
```php
if(isset($_POST['submit2']))
{
$usrnm=$_POST["username"];
$stts=$_POST["status"];
...
$updatequery="update book set Status='$stts[$j]' where username='$usrnm[$j]' and timestamp='$tmstmp[$j]'";
mysqli_query($conn, $updatequery);
}
```
An unauthenticated attacker can submit arbitrary `username[]`, `timestamp[]`, and `status[]` arrays to overwrite any appointment's status.
|
|---|
| Source | ⚠️ https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/15 |
|---|
| User | huimouwaner (UID 101296) |
|---|
| Submission | 09/16/2026 15:54 (1 month ago) |
|---|
| Moderation | 10/12/2026 21:04 (26 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 417189 [girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5 submit2 changebookingstatus.php username[]/timestamp[]/status[] authorization] |
|---|
| Points | 20 |
|---|