ScriptAndTools Real Estate Management System Redirect Vulnerability in /admin/userlist.php

A broken access control vulnerability has been identified in ScriptAndTools Real Estate Management System version 1.0. The issue resides in the file /admin/userlist.php, where an unknown function allows execution after a redirect. This vulnerability can be exploited remotely without authentication, leading to unauthorized access and information disclosure.

Impact

Exploitation of this vulnerability allows unauthorized access to sensitive user information via the admin/userlist.php page, bypassing the need to log into the admin panel.

Reproduction

To reproduce this vulnerability, use a web browser extension that disables automatic redirects, such as DH-Hackbar. Then, navigate to the vulnerable URL: http://<target>:8080/reali/admin/userlist.php. The sensitive user information will be accessible without logging into the admin panel.