PHPGurukul User Management System V3.3 Admin Panel Broken Access Control (CWE-863)

Vulnerability Overview Vulnerability Name: Broken Access Control in Improper Authorization / Password Change (Admin Panel) Researcher: Shailendra Mourya (CyberShailendra) Contact: cybershailendra1@gmail.com Product: User Registration, Login, and User Management System with Admin Panel Vendor: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ Version: V3.3 Vulnerability Type: CWE-863: Improper Authorization (Broken Access Control) Vulnerable File: (Lines 9-16) Vulnerable Parameter: (POST) Impact Range This vulnerability allows an attacker to change the password of the currently logged-in administrator account by submitting the password of any existing administrator account. Although the code uses prepared statements, completely eliminating SQL injection, the validation query still lacks the constraint, resulting in the vulnerability. Remediation Bind the current password check to the session user: POC Code Steps to Reproduce 1. Log in to the admin panel ( ). 2. Navigate to "Change Password" ( ). 3. Send a POST request where is set to the password of any existing administrator account in the database. 4. The query returns a match in the table, and the application updates the password of the administrator account associated with the current session. Impact Re-authentication controls are designed to prevent unauthorized changes during session hijacking (via stolen session tokens, XSS, or local browser access). Because this check is not bound to the account owner of the session, an attacker can bypass the re-authentication prompt using any valid administrator password in the system, thereby gaining persistent access to the hijacked account.

Goal Reached Thanks to every supporter — we hit 100%!

PHPGurukul User Management System V3.3 Admin Panel Broken Access Control (CWE-863)

More from this source