CVE-2026-10693
Improper Authorization in Online Boat Reservation System 1.0
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | online_boat_reservation_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Broken Access Control issue in the SourceCodester Online Boat Reservation System version 1.0. It allows low-privileged, authenticated users to access administrative functions without proper authorization.
Attackers can manipulate object identifiers, such as the 'editid' parameter, to directly access sensitive admin endpoints like /boat/admin/index.php and /boat/admin/boatsupdate.php?editid=78. This bypasses permission checks and lets unauthorized users perform administrative actions.
As a result, unauthorized users can modify boat details and tamper with application data that should only be accessible to administrators. The root cause is missing server-side authorization checks, allowing direct access to admin pages and data modification without proper validation.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users to perform administrative actions within the application.
- Unauthorized modification of boat details and other sensitive data.
- Compromise of data integrity due to unauthorized data tampering.
- Potential disruption of normal administrative operations.
Overall, it undermines the security and trustworthiness of the system by allowing low-privileged users to escalate their privileges and access restricted functions.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access administrative endpoints with a low-privileged user account and checking if unauthorized access is granted.
- Use an authenticated normal user account to send HTTP requests to admin endpoints such as /boat/admin/index.php and /boat/admin/boatsupdate.php?editid=78.
- Modify the 'editid' parameter in the URL to test if you can access or modify boat details without proper authorization.
- Example curl command to test access: curl -i -b cookies.txt https://targetsite.com/boat/admin/index.php
- Example curl command to test parameter manipulation: curl -i -b cookies.txt "https://targetsite.com/boat/admin/boatsupdate.php?editid=78"
If these requests succeed without proper authorization checks (e.g., no HTTP 403 Forbidden response), the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing strict server-side access controls and enforcing role-based permissions.
- Ensure that all administrative endpoints validate user privileges before granting access.
- Return HTTP 403 Forbidden errors for unauthorized access attempts to sensitive admin pages.
- Review and fix missing authorization checks on the server side to prevent direct access to admin functions by low-privileged users.
These steps will help prevent unauthorized users from performing administrative actions and tampering with application data.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows low-privileged users to bypass authorization and access administrative functions, leading to unauthorized modification of sensitive data and compromising data integrity.
Such unauthorized access and data tampering can result in non-compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive information.
Failure to enforce proper authorization and role-based permissions increases the risk of data breaches and unauthorized data manipulation, potentially violating regulatory requirements for data confidentiality, integrity, and accountability.