CodeAstro Complaint Management System Privilege Escalation Vulnerability Allowing Unauthorized Deletion of Complaints

A vulnerability in CodeAstro Complaint Management System version 1.0 allows unauthorized deletion of complaints through improper access control in the /admin/m_delete.php endpoint. Attackers can exploit this issue by manipulating the id parameter, enabling arbitrary deletion of complaints without the need for a valid session or privileges.

Impact

Exploitation of this vulnerability leads to unauthorized mass deletion of complaints.

Reproduction

To reproduce this vulnerability, access the admin directory to find the m_delete.php endpoint. Once located, modify the id parameter with different values to delete complaints. This can be done without any authentication or authorization, as the endpoint lacks proper access controls. Tools like Burp Suite or OWASP ZAP can be used to automate the discovery of the id parameter.