Executive brief
A security flaw exists in the CodeAstro Online Job Portal, a platform used for managing employment listings. An authenticated user, such as a registered employer, can exploit this vulnerability to delete job postings created by other users. This could lead to unauthorized data loss, disruption of recruitment activities, and damage to the platform's reputation.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in CodeAstro Online Job Portal 1.0 within the '/jobs/job-delete.php' file. The application fails to perform proper authorization checks to ensure that the authenticated user requesting a deletion is the owner of the specific job record. By manipulating the 'id' parameter in a GET request, a remote authenticated attacker (e.g., a registered employer) can delete job postings belonging to any other user. A public exploit (PoC) is available demonstrating this bypass of access controls.
Affected products
- CodeAstro Online Job Portal Project in PHP MySQL 1.0
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory