Executive Summary

This vulnerability exists in the Hotel and Tourism Reservation System 1.0, specifically in the Admin Login component's password_verify function located in /admin/login.php.

The issue arises from manipulation of the Password argument, which leads to improper authentication.

An attacker can exploit this vulnerability remotely, and the exploit is publicly available.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to bypass proper authentication mechanisms remotely.

As a result, unauthorized users could gain administrative access to the system.

This could lead to unauthorized control over the reservation system, potentially compromising sensitive data and system integrity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated remote attackers to bypass authentication and gain full administrative privileges, enabling them to view, modify, or delete sensitive data such as reservations and user information.

Such unauthorized access and potential data manipulation can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive data.

Therefore, exploitation of this vulnerability could result in non-compliance with these standards due to failure to protect user data confidentiality, integrity, and access controls.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to authenticate to the admin login page with a valid admin email address and an incorrect password. If the system incorrectly grants access and redirects to the admin dashboard, it indicates the presence of the authentication bypass.

A practical detection method involves sending a POST request to /ht/admin/login.php with the admin email and a fake password and observing the response.

• Use curl to test the login bypass: curl -X POST -d "[email protected]&password=wrongpassword" https://targetsite/ht/admin/login.php -v
• Check if the response includes a 302 redirect to the admin dashboard, which confirms the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to correct the authentication logic in the admin login code.

Specifically, the conditional branches in the password verification process should be swapped so that administrative access is granted only when password_verify() returns true.

Until a patch is applied, restrict access to the admin login page by IP filtering or other access controls to prevent unauthorized remote exploitation.

Monitor logs for suspicious login attempts using valid admin emails with incorrect passwords.

Useful 0 Not Useful 0