Computer Laboratory Management System 1.0 Privilege Escalation

# Exploit Title: Computer Laboratory Management System v1.0 - Incorrect access control# Date: 08 July 2024# Exploit Author: Sampath kumar kadajari# Vendor Homepage: https://www.sourcecodester.com/php/17268/computer-laboratory-management-system-using-php-and-mysql.html# Software Link: https://www.sourcecodester.com/download-code?nid=17268&title=Computer+Laboratory+Management+System+using+PHP+and+MySQL# Version: v1.0# CVE: CVE-2024-41332# Tested on: Windows, XAMPP, Apache, MySQL-------------------------------------------------------------------------------------------------------------------------------------------Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-level privileges to perform arbitrarily delete actions. "Vulnerable Code" – ( classes/master.php)function delete_category(){        extract($_POST);        $del = $this->conn->query("UPDATE `category_list` set `delete_flag` = 1 where id = '{$id}'");        if($del){            $resp['status'] = 'success';            $this->settings->set_flashdata('success'," Category successfully deleted.");        }else{            $resp['status'] = 'failed';            $resp['error'] = $this->conn->error;        }        return json_encode($resp);}---> Affected Component:  http://localhost/php-lms/classes/Master.php?f=delete_category"Fix for Vulnerable Code":function delete_category(){    // Check if the user is logged in and has an admin role    if (!isset($_SESSION['userdata']['role']) || $_SESSION['userdata']['role'] != 'admin') {        $resp['status'] = 'failed';        $resp['error'] = 'Unauthorized access.';        return json_encode($resp);    }    // Proceed with the delete action if authorized    extract($_POST);    $del = $this->conn->query("UPDATE `category_list` set `delete_flag` = 1 where id = '{$id}'");    if($del){        $resp['status'] = 'success';        $this->settings->set_flashdata('success',"Category successfully deleted.");    }else{        $resp['status'] = 'failed';        $resp['error'] = $this->conn->error;    }    return json_encode($resp);}