Codeastro Bus Ticket Booking System Insecure Direct Object Reference Vulnerability

A vulnerability allowing unauthorized access to user profiles has been identified in Codeastro Bus Ticket Booking System version 1.0. This Insecure Direct Object Reference (IDOR) issue arises from the absence of proper authentication and authorization checks, allowing attackers to manipulate the user ID in the URL and access another user's profile.

Impact

Exploitation of this vulnerability allows unauthorized users to access and view other users' profiles, potentially leading to unauthorized information disclosure.

Reproduction

To reproduce this vulnerability, log into the application and navigate to a user profile. Then, manually change the user ID in the URL to that of another user. If the profile is accessed without any authentication or authorization checks, the vulnerability is present.