Authenticated IDOR in Barangay BRPMS Management System (CWE-639)

Vulnerability Overview Affected Versions: Barangay Resident Profiling Management System (BRPMS) / Barangay San Fabian Current Repository Snapshot Vulnerability Type: Insecure Direct Object Reference (IDOR) / Access Control Severity: High Status: Unpatched CVE IDs: - CWE-639: Authorization Bypass Through User-Controlled Key - CWE-862: Missing Authorization Vulnerable Endpoints: - (GET) - (GET) - (GET) - (GET) - (POST parameters and ) Description: - There is an authenticated IDOR vulnerability in the board management module of the BRPMS. - The endpoints accept user-controlled values and directly perform read, update, archive, restore, and permanent delete operations on the corresponding rows. The code only checks if the user is logged in via , but does not verify whether the current user has permission to manage the selected object or if the operation requires a higher-privileged account. Impact Confidentiality: Unauthorized users can enumerate and view board records via predictable numeric IDs. Integrity: Unauthorized users can modify names, demographics, citizenship, voter status, and purok values. Availability: Unauthorized users can archive, restore, or permanently delete records. Access Control: Any logged-in user can perform sensitive object-level operations without object-level authorization. Remediation 1. Enforce object-level authorization before reading, updating, archiving, restoring, or deleting records. 2. Restrict destructive operations to privileged roles, such as the main administrator or dedicated roles. 3. Move archive, restore, and delete operations to POST-only routes, and reject GET requests for state changes. 4. Add CSRF protection to all state-change requests. 5. Require password confirmation for permanent deletion, matching the pattern used in other sensitive modules. 6. Log sensitive record changes, including user ID, timestamp, target object ID, and action. Proof of Concept (PoC) Permanent Deletion via GET: Archive Arbitrary Record via GET: Modify Arbitrary Record via POST: Explanation The attacker only needs a valid session. The application trusts the submitted and applies the action directly. There are no ownership checks, no permission checks for destructive operations, no confirmation using the current password, and no CSRF token. Permanent deletion is exposed via GET requests for state changes. References Source File: Authentication Helper:

Goal Reached Thanks to every supporter — we hit 100%!

Authenticated IDOR in Barangay BRPMS Management System (CWE-639)

More from this source