Security Vulnerability: Broken Access Control in Settings Controller

[sb3lr]

Description

I have discovered a critical security vulnerability in the current version of this project. The Settings controller fails to implement authentication checks in its constructor, allowing unauthenticated users to access and modify administrative settings.

---

Technical Details

• File: /application/controllers/Settings.php
• Issue: Missing is_login() and only_access() check in the __construct() method.
• Comparison: Unlike the Doctors controller which is protected, the Settings controller is exposed to the public.

---

Proof of Concept (PoC)

1. Open a browser in Incognito mode.
2. Go to:

http://<your-server>/index.php/settings

3. You will have full access to the settings dashboard without logging in.

---

Impact

An attacker can:

• View sensitive hospital information
• Modify configurations
• Manipulate department data

This compromises both:

• Confidentiality
• Integrity

---

Recommended Fix

Add the following check to the constructor in /application/controllers/Settings.php:

public function __construct() {
    parent::__construct();
    if(!is_login()){
        redirect(base_url('login'));
    }
    only_access(array("admin"));
}

---

Note

I have requested a CVE ID for this vulnerability to ensure it is properly documented.