A critical missing authorization vulnerability in code-projects Online Movie Streaming 1.0 allows remote, unauthenticated attackers to potentially bypass access controls.

This flaw stems from a lack of authorization checks within the admin-control.php script. An unauthenticated remote attacker can target the ID parameter to perform unauthorized actions, as the system fails to verify user permissions before processing requests.

The ability for an unauthenticated user to interact with administrative functions poses a significant risk to the integrity and confidentiality of the application. Given the CVSS score of 7.3, this high-severity vulnerability could lead to unauthorized administrative control, potentially resulting in data manipulation or further system compromise.

Immediate Action: As there is no official patch available, administrators should restrict access to the admin-control.php file via web server configuration or by placing the administrative interface behind a VPN or internal network segment.

Proactive Monitoring: Review web server access logs for anomalous requests to the admin-control.php endpoint, specifically monitoring for unusual ID parameters or unauthorized attempts to access administrative functionality.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the affected script and monitor for traffic patterns indicative of automated exploitation attempts.

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up found at the GitHub repository linked in the CVE references.

Due to the lack of an official patch and the public availability of exploit information, this vulnerability presents an elevated risk to installations of Online Movie Streaming 1.0. Organizations should immediately restrict access to the vulnerable administrative interface and prioritize moving to a supported or more secure alternative, as the current software appears to lack active security maintenance.