# CVE-2024-55506: Unauthorized User Account Deletion via IDOR and Directory Listing in CodeAstro's Complaint Management System v1.0

## Description

An IDOR vulnerability chained with a Directory Listing flaw allows an attacker to delete any user-level account, regardless of their session status with the application. By exploiting the vulnerable endpoint http://localhost/admin/delete.php?id=<user-id> and modifying the id parameter, the attacker can delete all user-level accounts without their consent or the admin's knowledge. This issue stems from the lack of proper authentication and authorization on the endpoint. The endpoint and the vulnerable id parameter can be discovered through fuzzing, directory listing (enabled by default), and brute-forcing with random wordlists, amplifying the impact of the vulnerability.

## Steps to Reproduce (PoC)

To reproduce the vulnerability, access the directory listing at http://localhost/admin/ to locate the delete.php endpoint. Navigate to http://localhost/admin/delete.php?id=<user-id> and modify the id parameter with different values (e.g., id=5, id=6) to delete user accounts. This endpoint can be abused even without a proper session or any privileges within the application, as it lacks authentication and authorization checks. Use tools like Burp Suite or OWASP ZAP with a wordlist to identify the id parameter if needed. Verify the impact by attempting to log in with deleted accounts and confirm the application's failure to enforce access controls, enabling unauthorized mass account deletion.

## Impact

Successful exploitation allows an attacker to achieve Unauthorized Mass Account Deletion.

## Credits

Discovered by Harish Kumar, December 2024.

## References

- CVE Record: https://www.cve.org/CVERecord?id=CVE-2024-55506