| 标题 | Dav-ee dairy-management-system f31a584c3330c013b61f8b0306d9e0849c6d693d Exposure of Private Personal Information to an Unauthorized Acto |
|---|
| 描述 | The affected component is `delivery/checkfarmer.json.php`, the AJAX endpoint used by the delivery form to look up a farmer. Unlike every other page, it only includes the database connection file and **does not include `incl/header.incl.php`**, which is where the session/authentication check lives. The endpoint takes `$_POST['fname']` (a farmer number) and returns the matching farmer's personal data:
```php
include_once '../incl/conn.incl.php';
$fname=$_POST['fname'];
$fqry= mysqli_query($conn,"select * from farmers where f_no='". mysqli_real_escape_string($conn, $fname) ."'") ...
?>
<span class='input-xlarge uneditable-input' ><?php echo $farmer['f_name']; ?></span>
...
<span class="input-xlarge uneditable-input" ...><?php echo $farmer['f_locallity']; ?></span>
<span class="input-xlarge uneditable-input" ><?php echo $farmer['f_ac']; ?> </span>
<span class="input-xlarge uneditable-input" ><?php echo $farmer['f_phone'] ?> </span>
```
An unauthenticated attacker can enumerate farmer numbers (`f_no` values are sequential) and harvest the full name, locality, **bank account number** (`f_ac`), and **phone number** (`f_phone`) of every registered farmer without logging in. This discloses sensitive personal and financial information of third parties. |
|---|
| 来源 | ⚠️ https://github.com/Dav-ee/dairy-management-system/issues/5 |
|---|
| 用户 | Elymas (UID 98074) |
|---|
| 提交 | 2026-10-02 14時33分 (19 日前) |
|---|
| 管理 | 2026-10-18 18時26分 (16 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 421856 [Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php fname 信息公开] |
|---|
| 积分 | 20 |
|---|