Computer Laboratory Management System 1.0 Privilege Escalation Vulnerability

# Exploit Title: Computer Laboratory Management System v1.0 - Incorrect access control
# Exploit Author: Sampath kumar kadajari
# Vendor Homepage: https://www.sourcecodester.com/php/17268/computer-laboratory-management-system-using-php-and-mysql.html
# Software Link: https://www.sourcecodester.com/download-code?nid=17268&title=Computer+Laboratory+Management+System+using+PHP+and+MySQL
# Version: v1.0
# CVE: CVE-2024-41332
# Tested on: Windows, XAMPP, Apache, MySQL

-------------------------------------------------------------------------------------------------------------------------------------------

Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-level privileges to perform arbitrarily delete actions. 


"Vulnerable Code" – ( classes/master.php)

function delete_category(){
        extract($_POST);
        $del = $this->conn->query("UPDATE `category_list` set `delete_flag` = 1 where id = '{$id}'");
        if($del){
            $resp['status'] = 'success';
            $this->settings->set_flashdata('success'," Category successfully deleted.");
        }else{
            $resp['status'] = 'failed';
            $resp['error'] = $this->conn->error;
        }
        return json_encode($resp);
}

---> Affected Component:  http://localhost/php-lms/classes/Master.php?f=delete_category

"Fix for Vulnerable Code":

function delete_category(){
    // Check if the user is logged in and has an admin role
    if (!isset($_SESSION['userdata']['role']) || $_SESSION['userdata']['role'] != 'admin') {
        $resp['status'] = 'failed';
        $resp['error'] = 'Unauthorized access.';
        return json_encode($resp);
    }

    // Proceed with the delete action if authorized
    extract($_POST);
    $del = $this->conn->query("UPDATE `category_list` set `delete_flag` = 1 where id = '{$id}'");
    if($del){
        $resp['status'] = 'success';
        $this->settings->set_flashdata('success',"Category successfully deleted.");
    }else{
        $resp['status'] = 'failed';
        $resp['error'] = $this->conn->error;
    }
    return json_encode($resp);
}