Critical Auth Bypass: Missing exit() in PHP redirect allows full unauthorized access to hospital data

Vulnerability Overview Title: Authentication can be bypassed - the only session check redirects without terminating execution #6 Description: In the file, the sole access control guard is a call to when the session is invalid. However, the function (defined in ) merely sets without an accompanying call. Consequently, the PHP request continues execution and transmits the complete page content (patient information, transaction data, account management, etc.) within the 302 response body following the redirect header. Any client that ignores the redirect can access the entire panel without authorization. Scope Affected Version: Commit: 9e795e6807314b4473116e06998ff76d1587616 (latest) Vulnerability Type: CWE-287 / CWE-306: Missing effective authentication enforcement Impact: Complete authentication bypass. Any anonymous user can read hospital patient/doctor/financial records, list and modify user accounts (see related account takeover findings), and view verification and reports. Other findings identified are also directly reachable over the internet. Remediation Affected Code: - File: (Guard for all pages) - File: Root Cause: Redirecting without calling or does not halt PHP execution. Since every admin page executes (which pulls sensitive content from earlier), the content is always generated and returned to anonymous visitors. Proof of Concept (POC) CVSS 3.1 Score Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Score: 9.8 Severity: Critical Calculator: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

Goal Reached Thanks to every supporter — we hit 100%!

Critical Auth Bypass: Missing exit() in PHP redirect allows full unauthorized access to hospital data

More from this source