| tiêu đề | SourceCodester Food Order Management System Unknown / Not specified Unauthenticated Administrative Access / Broken Access Control |
|---|
| Mô tả | The application contains multiple administrative endpoints that do not enforce authentication or authorization checks. While admin.php attempts to verify the session, several administrative endpoints, including add_admin.php, add_category.php, add_food.php, update_category.php, update_food.php, delete.php, delete_category.php, change_pwd.php, and edit_admin.php, can be accessed directly without an authenticated administrative session.
As a result, an unauthenticated attacker may be able to perform administrative operations, including creating administrative accounts, modifying application content, changing food prices, changing categories, modifying administrative accounts, and deleting application data.
Additionally, admin.php sends a redirect response when the session check fails but does not terminate script execution with exit, allowing subsequent page processing to continue.
The issue results from missing or incomplete server-side authorization checks on administrative functionality. |
|---|
| Nguồn | ⚠️ https://github.com/amanaparvin123-pixel/security-research/blob/main/food-order-admin-access.md |
|---|
| Người dùng | Amana_parvin (UID 101962) |
|---|
| Đệ trình | 07/10/2026 19:19 (cách đây 15 ngày) |
|---|
| Kiểm duyệt | 21/10/2026 08:56 (14 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 424699 [SourceCodester Food Order Management System 1.0 Admin Endpoint nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|