hotel-mgmt-system has an improper authentication logic vulnerability

[ArthurHendrich]

PoC - Proof of Concept

---

Initially, accessing the application's login page

Next, intercepting the request using Burp Suite and sending a login request with an invalid, random password.

Sending the request to the application successfully logs in, even with an incorrect password.

Code Review

---

When a user sends a login request, the process_login.php endpoint is called.

Upon reviewing the code, we can see that the function responsible for checking if the password is correct is isPasswordMatchWithEmail. If this function returns false, the password is considered incorrect.

However, upon inspecting the implementation of this function in CustomerHandler.php, it is evident that it returns a string instead of a boolean value.

As a result, whenever the function returns any non-empty string, PHP interprets it as true, allowing the login process to proceed even when the password is incorrect.