| 标题 | Kushan2k student-management-system 1.0 Unauthenticated Admin Profile Update Endpoint |
|---|
| 描述 | The `edit-admin` action in `AdminController.php` allows an administrator to update their email or password. However, the endpoint **does not verify whether the current user is logged in as an administrator** – there is no check for `$_SESSION['isadmin']` or similar. Any unauthenticated visitor can trigger the update logic by simply sending a POST request.
Furthermore, the underlying database operations in `config/User.php` build SQL queries by directly concatenating user‑supplied parameters:
```php
// getAdmin()
$res = $this->db->query("SELECT * FROM admin WHERE id={$id}");
// updateAdminEmail()
$res = $this->db->query("UPDATE admin SET email='{$email}' WHERE id={$id}");
// updateAdminPassword()
$res = $this->db->query("UPDATE admin SET password='{$newpass}' WHERE id={$id}");
```
These queries are vulnerable to SQL injection if the id or email parameters are manipulated. Combined with the missing authentication, an attacker can:
Modify any administrator’s email (leading to account takeover via password reset)
Change an admin’s password (locking them out)
Potentially exploit the SQL injection to read or modify other data |
|---|
| 来源 | ⚠️ https://github.com/Kushan2k/student-management-system/issues/3 |
|---|
| 用户 | Pr0x1ma (UID 98396) |
|---|
| 提交 | 2026-05-20 08時42分 (20 日前) |
|---|
| 管理 | 2026-06-07 11時38分 (18 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 369096 [Kushan2k student-management-system 直到 f16a4ceaddd6729c4b306ed4641cda3176c1ef2a Profile Update Endpoint AdminController.php edit-admin isadmin 权限提升] |
|---|
| 积分 | 20 |
|---|