Demokratian install3.php privileges management

Vulnerability

The vulnerability resides in install/install3.php, a post-installation script that remains accessible without authentication after the installation process. This allows any unauthenticated remote user to access the script and create a new administrator account. The issue affects all versions of Demokratian prior to the commit that fixes the broken authentication (commit 0d073ee461edd5f42528d41e00bf0a7b22e86bb3) [1].

Exploitation

An attacker with network access to the Demokratian web server can exploit this flaw by simply navigating to install/install3.php. No authentication or user interaction is required. The page presents a form for creating an administrative user; the attacker fills in the required fields (e.g., username, password) and submits, effectively gaining full administrative privileges [1].

Impact

Successful exploitation gives the attacker complete control over the voting application. As an administrator, the attacker can modify votes, access sensitive voter data, alter application settings, and compromise the integrity and availability of the system. This results in a total loss of confidentiality, integrity, and availability [1].

Mitigation

The vulnerability is fixed in the repository commit 0d073ee461edd5f42528d41e00bf0a7b22e86bb3. Users should apply this patch or upgrade to the latest master branch from the repository [1]. As a workaround, administrators should delete or restrict access to install/install3.php after initial setup. The fix was released by the developer Carlos Salgado [1].