| 标题 | code-projects Task Management System In PHP With Source Code 1.0 Authorization Bypass |
|---|
| 描述 | A vulnerability was found in Code-Projects Task Management System In PHP With Source Code. The affected file is /user/UpdateTaskStatus.php.
The endpoint checks whether the user_id session variable exists. When authentication fails, it destroys the session and sends a redirect to ../Logout.php. However, the script does not terminate execution after setting the Location header. The database update operation therefore continues to execute.
A remote unauthenticated attacker can submit task_id and val parameters without a Cookie or Authorization header and modify the status of an arbitrary task.
The following unauthenticated request was tested:
POST /PROJECT_NEW/user/UpdateTaskStatus.php HTTP/1.1
Host: TARGET
Content-Type: application/x-www-form-urlencoded
Connection: close
task_id=2&val=completed
The application returned:
HTTP/1.1 302 Found
Date: Mon, 22 Jun 2026 16:07:06 GMT
Location: ../Logout.php
Content-Type: text/html; charset=UTF-8
Content-Length: 7
updated
Before the request, task ID 2 had the status pending. After the unauthenticated request, the same task had the status completed.
This demonstrates that the application detects the missing session but continues executing the sensitive database operation. The issue allows remote unauthenticated modification of task workflow records.
The vulnerability is classified as CWE-862: Missing Authorization.
CVSS 3.1: 7.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected package:
TASK_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE.zip
SHA-256:
8a4bf7950b97ea99e05ff9655185678fc1b13b5d79099f3aa7060dd438ac1d54
Advisory and proof of concept:
https://github.com/littleRain1355/PHPissue/issues/4 |
|---|
| 来源 | ⚠️ https://github.com/littleRain1355/PHPissue/issues/4 |
|---|
| 用户 | rainless100792 (UID 84115) |
|---|
| 提交 | 2026-06-22 18時23分 (2 月前) |
|---|
| 管理 | 2026-08-08 15時32分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 387181 [code-projects Task Management System 1.0 UpdateTaskStatus.php task_id/val 权限提升] |
|---|
| 积分 | 20 |
|---|