Real Estate Management System V 1.0 | /admin/userlist.php | Broken Access Control| Found By Maloy Roy Orko
Hi all, I am Maloy Roy Orko. Recently,in one of my pentest research,I found a web application project and it was Real Estate Management System by Script and Tools. So, I downloaded this and started to find vulnerabilities if it has. Surprisingly,I found Broken Access Control vulnerability and for specifically CWE-698: Execution After Redirect (EAR ) in /admin/userlist.php CVE Number : In Review CWE Number : CWE-284 ,CWE-698 Source Code Review: As you can see ,There are no die() or exit() after header() redirect! That's why,this vulnerability is occuring! Some Important Informations: Title of the Vulnerability: Real Estate Management System V 1.0 | /admin/userlist.php | Broken Access Control| Found By Maloy Roy Orko Vulnerability Class: Broken Access Control Product Name : Real Estate Management System Vendor : https://github.com/scriptandtools/ Vulnerable Product Link: https://github.com/scriptandtools/Real-Estate-website-in-PHP Vulnerable File/Component...