Description

A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.php of the component Restore/Delete. The manipulation of the argument resident_id results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-23T22:16:32.903Z",
  "pubdate": "2026-08-23T22:16:32.903Z",
  "executiveSummary": "An authorization bypass vulnerability was identified in the code-projects Barangay Resident Profiling Management System 1.0, specifically within the Restore/Delete component located at /archived_records.php. This security flaw impacts an unknown function responsible for processing resident records and exposes the application to remote attackers. By manipulating the resident_id argument, unauthorized users can bypass access control mechanisms and potentially execute restricted administrative actions concerning archived records. The risk implications are severe, as public exploits for this vulnerability are readily available, lowering the threshold for malicious actors to compromise data integrity and system security without prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides in the Restore/Delete component of the code-projects Barangay Resident Profiling Management System 1.0, specifically interacting with the /archived_records.php endpoint. The root cause of the flaw stems from deficient or completely absent server-side authorization checks when processing requests involving the resident_id parameter. In a standard secure implementation, the application should rigorously validate whether the currently authenticated session possesses the necessary administrative privileges or access rights before permitting state-changing operations such as restoring or deleting archived records.\nBecause of this missing access control validation, the application blindly trusts the input supplied within the resident_id argument. The attack flow initiates when a remote, unauthenticated, or low-privileged attacker crafts a malicious HTTP request targeting /archived_records.php. By manipulating the resident_id parameter value within the request string, the attacker can force the backend database queries or logic handlers to perform unauthorized actions on arbitrary records. The payload behavior bypasses the intended security boundary of the Restore/Delete functionality, allowing unauthorized entities to execute privileged routines.\nThe network exposure for this vulnerability is remote, meaning an attacker does not require local access to the underlying host server to initiate the exploit. Exploitation requirements are minimal due to the public availability of exploit code, enabling automated or scripted attacks against vulnerable deployments of Barangay Resident Profiling Management System 1.0. The post-exploitation impact includes unauthorized data deletion, unintended record restoration, and potential disruption of system data integrity, leading to a complete compromise of the affected resident profiling records."
}