Authentication Bypass via User/Login.php Fallback to Admin Table Leading to Super Admin Takeover

Vulnerability Overview Title: User/login.php fallback to admin table — Valid admin credentials submitted via public login result in silent super-admin login. Summary: first queries the table. If no match is found, it executes the same SQL query against the table. If a match is found, it sets and from the admin record and redirects to , thereby granting full administrative access. This contradicts the intended behavior of the frontend public login. Combined with CVE-12 (admin pages without role checks) and CVE-15 (unauthorized password changes), the risk threshold for complete account takeover is very low: an attacker only needs to know or guess any administrator's email/password to become a super-admin. The lab demonstrated this by logging in as via and immediately accessing . Affected Versions: Commit: Vulnerability Type: Authentication Bypass via Alternate Channel / Improper Authentication Affected Code: Root Cause: The credential validation logic is duplicated across two tables, where rows populate the session with an identical structure. The first lookup acts as a soft gate, while the second acts as a backdoor. Since each admin page only checks , the admin table entries resulting from the fallback are indistinguishable from those resulting from . The intent to distinguish between (User vs. Admin) was never encoded into the session data. Impact Scope Any attacker capable of guessing or learning an administrator's email/password can authenticate via the public user login. No logs distinguish logins originating from "legitimate" admin logins. Once accessed, the fallback path provides full access to menu CRUD, table CRUD, all orders, user lists (including the plaintext password column), admin order indexes, and the admin . Storing administrator credentials alongside user credentials using the same column makes credential seeding from user to admin trivial. CVSS 3.1 Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (Critical) Remediation 1. Separate Session Data: Ensure that user and administrator session data differ structurally to allow for explicit differentiation. 2. Role Checks: Implement strict role-based access controls on all admin pages to ensure only users with the appropriate role can access them. 3. Logging: Log all login attempts, including source and result, to facilitate the detection and response to suspicious activities. 4. Password Storage: Use distinct password storage mechanisms or fields to prevent mixing administrator and user credentials. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Authentication Bypass via User/Login.php Fallback to Admin Table Leading to Super Admin Takeover

More from this source