| Title | KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 Missing Authentication |
|---|
| Description | The affected components are the state-changing endpoints in the repository root and in `admin/` that include only the database connection and never `session.php`:
```php
// remove_announcements.php (root)
<?php include('admin/dbcon.php'); ?>
<?php
$id = $_POST['id'];
mysql_query("delete from teacher_class_announcements where teacher_class_announcements_id = '$id'")or die(mysql_error());
?>
```
```php
// admin/de_activate.php
<?php
include('dbcon.php');
$get_id = $_GET['id'];
mysql_query("update teacher set teacher_stat = 'Deactivated' where teacher_id = '$get_id'");
header('location:teachers.php');
?>
```
```php
// admin/delete_student.php
<?php
include('dbcon.php');
if (isset($_POST['delete_student'])){
$id=$_POST['selector'];
...
mysql_query("DELETE FROM student where student_id='$id[$i]'");
```
Affected endpoints include `remove_announcements.php`, `remove_student.php`, `delete_file.php`, `delete_class.php`, `delete_class_event.php` (root) and `admin/de_activate.php`, `admin/delete_student.php`, `admin/delete_teacher.php`, `admin/delete_users.php`, `admin/delete_class.php`, `admin/delete_department.php`, `admin/delete_subject.php`, `admin/delete_sy.php`, `admin/delete_event.php`, `admin/save_student.php` (admin). Every one of them accepts its target identifier from `$_POST`/`$_GET` and concatenates it into a DELETE/UPDATE/INSERT statement. An anonymous attacker can therefore delete or deactivate arbitrary database rows — including whole tables by injecting `1 OR 1=1` into the id — without any session cookie, and `admin/student_table.php` / `student_table_reg.php` / `student_table_unreg.php` serve the full student list (names and usernames) to anonymous users as well. There is no CSRF token anywhere in the application, so these operations can also be triggered from a third-party page through a logged-in victim's browser.
|
|---|
| Source | ⚠️ https://github.com/KusalkaSilva/Learning-Management-System/issues/5 |
|---|
| User | vuldb2026 (UID 101467) |
|---|
| Submission | 09/22/2026 17:45 (19 days ago) |
|---|
| Moderation | 10/11/2026 19:30 (19 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416734 [KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2 State-Changing Endpoints remove_announcements.php mysql_query id missing authentication] |
|---|
| Points | 20 |
|---|