SourceCodester Lost and Found Information System access control

Vulnerability

The vulnerability exists in the admin/?page=user/manage_user page of SourceCodester Lost and Found Information System version 1.0. The save_users() function does not enforce proper authorization checks when creating or modifying user accounts. A staff-level user can manipulate the type parameter to create a user with admin privileges, bypassing intended role restrictions. The affected code path is reachable by any authenticated user with staff permissions.

Exploitation

An attacker must first authenticate as a staff user. The attacker then visits the vulnerable page and submits a request to create a new user, setting the type field to admin. The application does not verify that the current user has permission to assign admin roles, allowing the attacker to create an admin account. The attacker can then log in with the newly created admin account to gain full control. The proof of concept steps are documented in the public exploit [1].

Impact

Successful exploitation results in privilege escalation from staff to admin. The attacker gains unrestricted access to all administrative functions, including user management, system configuration, and sensitive data. This compromises the confidentiality, integrity, and availability of the application.

Mitigation

As of the publication date, no official patch has been released by the vendor. The application is end-of-life or unsupported. Mitigation requires implementing proper access control checks in the save_users() function to ensure only users with appropriate privileges (e.g., existing admin users) can create or modify admin accounts. Until a fix is applied, administrators should restrict staff user accounts and monitor user creation activity.