Executive brief
A security vulnerability exists in the code-projects Smart Parking System, a software platform used to manage parking reservations and attendant staff. An attacker can bypass the login screen to access administrative functions without a password. This allows unauthorized individuals to view customer personal information, delete parking records, or create new staff accounts, potentially leading to a complete takeover of the system's operations and data.
Technical details
The Smart Parking System 1.0 fails to implement authentication checks (CWE-306) across multiple critical PHP endpoints within the admin component. A remote, unauthenticated attacker can bypass the login mechanism by sending direct GET requests to files such as attendant.php, edit.php, basic_table.php, and admin_request.php. This flaw allows for the creation of rogue attendant accounts, unauthorized modification or deletion of parking records, and the exfiltration of customer PII and booking data. The vulnerability stems from a lack of session validation at the top of these sensitive scripts. No patch is currently known to be available.
Affected products
- code-projects Smart Parking System 1.0
Timeline
- 2026-06-01: disclosed: Public disclosure of the vulnerability and exploit details.
- 2026-06-01: advisory: CVE-2026-10243 published.