Description

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit_user_account.php of the component User Account Update. Such manipulation of the argument id/username leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-23T10:16:28.573Z",
  "pubdate": "2026-08-23T10:16:28.573Z",
  "executiveSummary": "An improper authorization vulnerability has been identified within SourceCodester Class and Exam Timetabling System 1.0, specifically residing in the User Account Update component handling administrative modifications.\nThe vulnerability allows remote attackers to manipulate specific parameters, leading to unauthorized actions and unauthorized access to administrative functions.\nThe affected product is SourceCodester Class and Exam Timetabling System version 1.0, and the flaw specifically impacts the /admin/edit_user_account.php script.\nRisk implications include potential privilege escalation, unauthorized account modification, and compromise of user data integrity within the application.\nThe attack vector is remote, and publicly disclosed exploit materials increase the likelihood of opportunistic exploitation against vulnerable deployments lacking proper access controls.",
  "technicalDetails": "The root cause of the vulnerability stems from improper authorization enforcement within the User Account Update component of SourceCodester Class and Exam Timetabling System 1.0.\nThe vulnerability is exposed via the /admin/edit_user_account.php file, where the processing of input parameters such as the id or username lacks sufficient validation and access verification checks to ensure the requesting entity possesses the requisite administrative privileges.\nAttackers can leverage this flaw remotely by interacting with the vulnerable endpoint and manipulating the target parameters during the user account update process.\nThe attack flow proceeds as follows: an authenticated or unauthenticated remote attacker (depending on the baseline session handling of the script) crafts a malicious HTTP request targeting /admin/edit_user_account.php.\nBy supplying arbitrary or manipulated values in the id or username parameters, the attacker bypasses the intended authorization boundaries designed to restrict account modifications.\nDue to the absence of robust server-side access control checks verifying whether the current session is authorized to modify the specified target account, the application processes the request and executes the update operation.\nNetwork exposure is fully remote, as the application interface is typically hosted on web servers accessible via standard HTTP/HTTPS protocols.\nThe post-exploitation impact includes unauthorized modification of user accounts, potential privilege escalation to administrative roles, and subsequent compromise of system confidentiality, integrity, and availability."
}