CVE-2024-4819: Medium Improper Authorization in Campcodes Laundry

CVE-2024-4819 is a medium severity improper authorization flaw in Campcodes Online Laundry Management System 1.0, scored 4.3. The type argument handled in admin_class.php is trusted when it should be checked, which affects account roles. No fixed version is listed, so restrict access and review the code.

What's affected

The record names Campcodes Online Laundry Management System 1.0, file admin_class.php. The description says manipulating the type argument with the input 1 leads to improper authorization. The weaknesses are CWE-285, improper authorization, and CWE-639, authorization bypass through a user controlled key. The record says the attack can start remotely and a public disclosure exists. The record lists no fixed version and I could not confirm one from the sources, so verify with the project before assuming a patch exists.

Here NVD is a notch lower than the other records on this product: 4.3 Medium with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. VulDB's wording calls it problematic, not critical, so the two sources agree this time. The KEV flag is false.

The record does not explain what the type value controls. In user management code, a field named type commonly marks an account level, so check whether your copy lets a user alter that field. Treat that as something to verify in the code and not as a confirmed fact from the sources.

How to check if you're exposed

1. Find the application and confirm it is version 1.0.
2. Read how admin_class.php handles the type value on user save actions.
3. Check whether a normal account can submit a different role value and have it accepted.
4. Review the user table for accounts with elevated types that you did not create.

What to do now

1. Restrict the application to trusted networks.
2. On the server, ignore role values sent by the client when users save their own profile, and set roles only in an admin only function.
3. Audit the user table and remove unknown admin accounts.
4. Rotate passwords and sessions.
5. Review the other records on this product, including the SQL injection and identifier ones.
6. Move to a maintained product if you need long term support.

Why it matters

Authorization is the check that follows login. Passing authentication only proves who you are. Whether you may do a thing is a separate decision, and CWE-285 is what happens when the code skips it.

The low score reflects limited integrity impact, but role changes are exactly the type of small step that unlocks larger ones. A file that mixes login, saving and deletion in one class, as this one does, gives that kind of bug many places to hide.

Quick check

Sources

• Public write up referenced by the record (not read)
• VulDB entry 263940 (not readable without a browser session)
• NVD record data for CVE-2024-4819

Last reviewed: 19 October 2026.