An unauthenticated authorization bypass vulnerability in code-projects Online Movie Streaming 1.0 poses a significant risk as it allows remote attackers to perform unauthorized actions.

This vulnerability involves a missing authorization flaw (CWE-862) within the admin.php file. The issue allows an unauthenticated remote attacker to manipulate the ID argument, effectively bypassing access controls.

The ability for unauthenticated users to interact with administrative functions introduces a high risk of unauthorized data access or system manipulation. With a CVSS score of 7.3, this flaw is considered High severity, as it facilitates remote exploitation without requiring any prior user credentials. Organizations utilizing this software face potential service disruption and unauthorized administrative control over the application.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the administrative interfaces of the application or disable the affected component if it is not business critical.

Proactive Monitoring: Monitor server access logs for suspicious requests directed at admin.php, particularly those containing irregular or unexpected ID parameter values.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block unauthorized requests targeting the admin.php endpoint, specifically looking for attempts to bypass authentication logic.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub issue repository.

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires urgent attention. If you are running version 1.0, you must implement stringent network-level access controls immediately to prevent unauthenticated access to the administrative backend. Monitor for vendor updates and apply them as soon as they become available to permanently resolve the underlying authorization flaw.