Project

General

Profile

Actions

Bug #64

closed

Admin Creation API Accepts Invalid and Oversized Input Without Validation (Web-API)

Added by Vivek Kumar 21 days ago. Updated 18 days ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Start date:
03/31/2026
Due date:
% Done:

100%

Estimated time:
Spent time:

Description

While testing the Admin Creation functionality, it was observed that the API accepts invalid, incorrectly formatted, and excessively large input values across multiple fields without any validation errors.
This results in incorrect data being stored in the system, which may affect data consistency and application behavior.

Steps to Reproduce

  1. Open Admin Creation API
  2. Send a POST request with:
  3. Large text values in input fields
  4. Invalid email format
  5. Non-numeric values in numeric fields
  6. Submit the request

Actual Result
API returns success response:

{
  "success": true,
  "message": "Registered successfully"
}

Data is stored successfully in database with invalid values

Expected Result
System should validate inputs before processing:

  • Reject invalid email formats for email
  • Restrict input length for text fields such as:

first_name
last_name
address
City
state

  • Enforce numeric-only values for:

phone
zip

  • Validate password constraints for:

password
secondary_password (length, allowed characters, consistency rules)

API should return appropriate validation error messages for each invalid field instead of success response.

NOTE: A request in postman is there for producing the error.

Actions

Also available in: Atom PDF