Client Details System V1.0 Insecure Direct Object Reference (IDOR)

[hellonewbie]

NAME OF AFFECTED PRODUCT(S)

• Client Details System

Vendor Homepage

• [Client Details System In PHP With Source Code - Source Code & Projects](https://code-projects.org/client-details-system-in-php-with-source-code/)

AFFECTED AND/OR FIXED VERSION(S)

submitter

• LiuJiying

VERSION(S)

• V1.0

Software Link

• [Client Details System In PHP With Source Code - Source Code & Projects](https://code-projects.org/client-details-system-in-php-with-source-code/)

PROBLEM TYPE

Vulnerability Type

• Broken Access Control (Vertical Privilege Escalation)
• Insecure Direct Object Reference (IDOR) on destructive actions
• Sensitive Information Exposure (plaintext passwords in user listing)

Root Cause

• Authorization checks only verify that $_SESSION['login'] is non-empty and do not enforce roles or permissions.
• Both admin and non-admin pages include the same weak guard: include("checklogin.php"); check_login(); which merely redirects unauthenticated users.
• Data queries are unscoped: pages fetch and render all records to any logged-in user.
• Destructive operations are triggered via GET parameters without role checks or CSRF protection.

Impact

• Any authenticated user (e.g., the newly created user 78910 ) can view and modify “Client Details” and “Manage Users” pages intended for admins.
• Full exposure of client PII (names, emails, phone numbers), and of users’ plaintext passwords.
• Unauthorized deletion or modification of records via crafted URLs.
• Practical vertical privilege escalation: regular users operate with admin-level visibility and actions.

DESCRIPTION

• The application treats “logged in” as sufficient to access admin functionality. There is no role-based access control (RBAC) or per-record scoping.
• As shown in the screenshots, user 123456 and the newly created user 78910 both see the same “Client Details” page and navigation. This matches the code where check_login() only verifies session presence.
• Admin pages ( admin\clientview.php , admin\manage-users.php ) render to any logged-in session and expose sensitive data and admin actions.

Vulnerability details and POC

Vulnerability type:

• Broken Access Control (Vertical Privilege Escalation)
• Insecure Direct Object Reference (IDOR) on destructive actions
• Sensitive Information Exposure (plaintext passwords in user listing)

Payload:

Attack results