| 标题 | SOURCECODESTER Employee Task Management System 1.0 / changePasswordForEmployee.php Broken Authentication |
|---|
| 描述 | The Employee Task Management System: changePasswordForEmployee.php page is missing all types of authentication and authorization functionality which can allow a remote attacker to compromise all application user(s) accounts including admin.
Vendor Homepage:
https://www.sourcecodester.com
Software Link:
Employee Task Management System (https://www.sourcecodester.com/php/15383/employee-task-management-system-phppdo-free-source-code.html)
Version:
v 1.0
Affected Page:
changePasswordForEmployee.php
On this page, the application isn't verifying the authentication/authorization mechanism. Due to that, all the parameters are vulnerable to broken authentication.
Description:
Broken Authentication allows unauthenticated remote attackers to change the password of all/any application user(s).
Proof of Concept:
1- Visit the vulnerable page: changePasswordForEmployee.php
2- Type any random password which needs to update against any user_id and submit
3- Intercept that request through Burp Suite
4- update the user_id parameter with 1 (most of the application 1 is identical for admin user) and submit
5- The application will change the password and successfully log in to the application.
Recommendation:
Whoever uses this CMS, should update the authentication and authorization mechanism on top of the changePasswordForEmployee.php as per their requirement to avoid a Broken Authentication attack: |
|---|
| 来源 | ⚠️ https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Employee%20Task%20Management%20System%20-%20Broken%20Authentication.md |
|---|
| 用户 | navaidansari (UID 41266) |
|---|
| 提交 | 2023-02-17 22時56分 (4 年前) |
|---|
| 管理 | 2023-02-18 08時39分 (10 hours later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 221454 [SourceCodester Employee Task Management System 1.0 changePasswordForEmployee.php 弱身份验证] |
|---|
| 积分 | 20 |
|---|