therecluse26 / PHP-Login

A login system built with PHP, MySQL, jQuery and Bootstrap
MIT License
836 stars 442 forks source link

Security regarding ajax API #160

Closed daniel-falk closed 6 years ago

daniel-falk commented 6 years ago

It seems as if there is no check to see if a request to admin/ajax/deluserajax.php has a valid session or not. This means that an anonymous user can remove other users and possibly verify himself using this API as long as he knows the uid. Especially considering that the uid is used in the frontend (when you are logged in) this doesn't seem very safe..