by Kastro CVE-2024-46293
online_medicine_ordering_system_project online_medicine_ordering_system — Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control.
Description · from the CVE record
Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control. There is a lack of authorization checks for admin operations. Specifically, an attacker can perform admin-level actions without possessing a valid session token. The application does not verify whether the user is logged in as an admin or even check for a session token at all.
Affected
ProductAffectedFixed inSource
n/an/a–CNA
online_medicine_ordering_system1.0–CISA-ADP
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total