search

gcivil-nyu-org / wed-fall24-team3

2 stars 0 forks source link

Testing party bug - Unauthorized Access to Admin Dashboard and Event Manipulation #128

Closed shub-garg closed 5 days ago

shub-garg commented 1 week ago

Both users and creators are able to navigate to the Admin Dashboard URL (http://eventsphere-env2.eba-garccznv.us-west-2.elasticbeanstalk.com/events/events/) and perform administrative actions such as editing or deleting events. This unauthorized access undermines the security and integrity of the event management system by allowing non-admin roles to modify or remove events.

Steps to Reproduce:

  1. Login as a user or creator.
  2. Navigate to http://eventsphere-env2.eba-garccznv.us-west-2.elasticbeanstalk.com/events/events/.
  3. Attempt to edit or delete any event.
  4. Observe that the actions are permitted despite insufficient privileges.
simarmehta commented 1 week ago

Similar to the last one looks like a problem throughout, will handle hardcoding errors @shub-garg .