Executive brief
Barangay Resident Profiling Management System is a PHP-based application used to manage and profile residents in a barangay (village). An authorization flaw allows any logged-in user to view, modify, archive, or permanently delete resident records belonging to other users by manipulating a numeric ID parameter, exposing sensitive demographic data and enabling data tampering or destruction without proper access controls.
Technical details
An Insecure Direct Object Reference (IDOR) / Broken Access Control vulnerability exists in the boarder management module (/boarders.php) where user-controlled ID parameters in GET and POST requests are processed without object-level authorization checks. The application verifies only that a user is logged in via check_login() but does not validate whether the requesting user is authorized to access or modify the specific boarder record. Attackers authenticated as any non-administrative user can craft requests with sequential numeric IDs to read, update (archive/restore), or permanently delete arbitrary resident records. State-changing operations are exposed via GET requests without CSRF protection or password confirmation. The vulnerability is unauthenticated-optional but requires valid session cookies; no public patch is currently available.
Affected products
- code-projects Barangay Resident Profiling Management System 1.0
Timeline
- 2026-07-07: disclosed: Public disclosure on GitHub Gist
- 2026-08-23: other: CVE-2026-78144 published