Description

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task_id/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-09T10:17:10.387Z",
  "pubdate": "2026-08-09T10:17:10.387Z",
  "executiveSummary": "A missing authorization vulnerability has been identified in the code-projects Task Management System 1.0 application. Specifically, the flaw resides within the /user/UpdateTaskStatus.php file, where the manipulation of the task_id/val argument allows unauthorized entities to perform state-changing operations.\nThis vulnerability directly impacts the access control mechanisms of the system, potentially allowing remote attackers to arbitrarily modify task statuses without verifying the session context, role privileges, or object ownership of the user initiating the request.\nThe risk implications are significant for deployments utilizing this software, as malicious actors can disrupt operational workflows, alter project deliverables, or manipulate sensitive task tracking metrics across the platform.\nExploitation of this vulnerability requires network access to the target web application, but no complex interaction or prior authentication is explicitly restricted by the vulnerable endpoint, lowering the barrier to entry for potential attackers.\nPublicly available exploit material increases the urgency for defensive action, as automated scanners and malicious actors can readily leverage the disclosed attack vector to target vulnerable installations.",
  "technicalDetails": "The root cause of this vulnerability stems from a fundamental failure in the application's access control enforcement logic within the vulnerable component located at /user/UpdateTaskStatus.php.\nDuring the processing of HTTP requests intended to modify task states, the backend script processes input parameters specifically identified as task_id/val without performing rigorous validation to confirm whether the currently authenticated session possesses the requisite authorization to modify the specified resource.\nThe attack flow begins when a remote attacker crafts an HTTP request targeting /user/UpdateTaskStatus.php. By supplying arbitrary or enumeratable values within the task_id/val parameter, the attacker bypasses intended logical workflow restrictions.\nBecause the server-side code fails to implement proper session-to-resource binding and lacks function-level access control checks, it blindly accepts the supplied parameter and executes the database query or state update logic.\nThe affected product and version in this context is code-projects Task Management System 1.0, with the network exposure encompassing any deployment accessible via standard HTTP/HTTPS protocols over the network.\nThe post-exploitation impact includes unauthorized state transitions of system tasks, data integrity compromise, and potential operational disruption within the affected task management environment, as attackers can maliciously toggle task statuses across the system."
}