I am creating a web-app using PHP and jQuery Ajax for my client-side. When I was testing some security stuff, I thought of inserting a malicious user account with admin access in the database by executing an Ajax call from the developer's console in Google Chrome:
$.ajax({
url: base_url + "callbacks/AccountSettingsCallback/addUpdateAccount",
type: "POST",
data: {
"addUpdateAccount": 1,
"id": ""
"first_name": "hack",
"last_name: "hack",
"username": "gethack",
"password": "1234",
"account_type": 1
},
dataType: "JSON",
success: function(data) {
console.log("get hacked")
}
});
To my surprise, it was actually executed and the data has been inserted into the database, even though I was not logged in and should not have been able to do that!
I know that this is a very critical vulnerability, so my question is, what are the ways to prevent this kind of attack? Is there anyway to check via PHP wheather the request came from the console?