| tiêu đề | Object deletion |
|---|
| Mô tả | A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects on how the functions contained in ajax.php file will work with their parameters. When the expected parameter and fuctions are passed in POST parameters it expects an ID argument.
It's possible to delete and create objects without validation, which leads to Ar an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-306.
function delete_category(){
extract($_POST);
$delete = $this->db->query("DELETE FROM category_list where id = ".$id);
if($delete)
return 1;
Are one of the vulnerable functions when abused could arbitrary delete informations from the web application.
admin_class.php contains the instructions of which function and how it works, and notices all of them are vulnerable to manipulation of the application resources without authorization handling.
|
|---|
| Nguồn | ⚠️ https://cwe.mitre.org/data/definitions/306.html |
|---|
| Người dùng | Qnsx (UID 41280) |
|---|
| Đệ trình | 17/02/2023 20:00 (cách đây 4 những năm) |
|---|
| Kiểm duyệt | 18/02/2023 08:41 (13 hours later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 221455 [SourceCodester Online Pizza Ordering System 1.0 POST Parameter ajax.php delete_category xác thực yếu] |
|---|
| điểm | 17 |
|---|