Execution After Redirect - task-info.php.md

SOURCECODESTER / Employee Task Management System - Execution After Redirect task-info.php

Credits

Joshua Lictan (https://github.com/skid-nochizplz/skid-nochizplz)

Vendor Homepage:

https://www.sourcecodester.com/php/17217/employee-management-system-php-and-mysql-free-download.html

Affected Component

/task-info.php

Code

if ($user_id == NULL || $security_key == NULL) {
    header('Location: index.php');
}

Tools

Burp Suite

Proof of Concept

1. Using Burp, intercept the GET request to /manage-admin.php.

2. After capturing the GET request to /manage-admin.php, intercept the response to the request and forward the request.

3. Change the response HTTP status from "302 Found" to "200 OK" and click forward.

4. Now you can successfully access /manage-admin.php without authentication.