Computer Laboratory Management System 1.0 Privilege Escalation

`# Exploit Title: Computer Laboratory Management System v1.0 - Incorrect access control  
# Date: 08 July 2024  
# Exploit Author: Sampath kumar kadajari  
# Vendor Homepage: https://www.sourcecodester.com/php/17268/computer-laboratory-management-system-using-php-and-mysql.html  
# Software Link: https://www.sourcecodester.com/download-code?nid=17268&title=Computer+Laboratory+Management+System+using+PHP+and+MySQL  
# Version: v1.0  
# CVE: CVE-2024-41332  
# Tested on: Windows, XAMPP, Apache, MySQL  
  
-------------------------------------------------------------------------------------------------------------------------------------------  
  
Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-level privileges to perform arbitrarily delete actions.   
  
  
"Vulnerable Code" – ( classes/master.php)  
  
function delete_category(){  
extract($_POST);  
$del = $this->conn->query("UPDATE `category_list` set `delete_flag` = 1 where id = '{$id}'");  
if($del){  
$resp['status'] = 'success';  
$this->settings->set_flashdata('success'," Category successfully deleted.");  
}else{  
$resp['status'] = 'failed';  
$resp['error'] = $this->conn->error;  
}  
return json_encode($resp);  
}  
  
---> Affected Component: http://localhost/php-lms/classes/Master.php?f=delete_category  
  
"Fix for Vulnerable Code":  
  
function delete_category(){  
// Check if the user is logged in and has an admin role  
if (!isset($_SESSION['userdata']['role']) || $_SESSION['userdata']['role'] != 'admin') {  
$resp['status'] = 'failed';  
$resp['error'] = 'Unauthorized access.';  
return json_encode($resp);  
}  
  
// Proceed with the delete action if authorized  
extract($_POST);  
$del = $this->conn->query("UPDATE `category_list` set `delete_flag` = 1 where id = '{$id}'");  
if($del){  
$resp['status'] = 'success';  
$this->settings->set_flashdata('success',"Category successfully deleted.");  
}else{  
$resp['status'] = 'failed';  
$resp['error'] = $this->conn->error;  
}  
return json_encode($resp);  
}  
`