Description

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-04T11:17:19.433Z",
  "pubdate": "2026-09-04T11:17:19.433Z",
  "executiveSummary": "A critical security vulnerability identified as missing authorization exists within the SourceCodester Class and Exam Timetabling System version 1.0.\nThe flaw specifically affects the /admin/session.php component, where improper handling of the ID argument allows unauthorized access to sensitive administrative functions.\nThis vulnerability is classified as an authorization bypass, which enables remote attackers to manipulate system state or retrieve administrative data without valid credentials.\nBecause the exploit vector is publicly available, the risk to deployments is high, potentially allowing unauthorized actors to perform administrative actions, leading to complete system compromise or data exposure.\nThe vulnerability does not require complex prerequisites for exploitation, as it can be triggered remotely by targeting the improperly secured parameter within the application's administrative control flow.",
  "technicalDetails": "The vulnerability originates from a failure to implement robust access control checks within the /admin/session.php file of the Class and Exam Timetabling System 1.0.\nThe root cause is identified as an authorization bypass resulting from insecure input handling of the ID argument. In a properly architected system, session management and administrative access should be verified through server-side session token validation prior to executing logic based on user-supplied identifiers.\nThe attack flow involves an attacker bypassing authentication by directly accessing the /admin/session.php endpoint and manipulating the ID parameter. Since the application fails to verify whether the requester possesses the appropriate session state or administrative privileges, the underlying script proceeds to execute privileged operations or expose sensitive information mapped to the provided ID.\nBecause the vulnerability exists at the entry point of the administration layer, the lack of a session validation layer allows the application to assume the request is authorized by default. This indicates an insecure design pattern where security-critical logic is performed on the basis of unverified client-provided data.\nExploitation is achieved remotely by crafting an HTTP request targeting the affected script with a modified ID parameter. The attacker does not need to bypass traditional login screens if the backend logic for session management in /admin/session.php implicitly trusts the user-supplied data without verifying the integrity or origin of the request.\nThe post-exploitation impact is severe, as successful manipulation of the ID parameter can lead to unauthorized data retrieval, administrative session hijacking, or the execution of administrative functions that should remain restricted to authenticated, high-privileged users. Given the public nature of the exploit, the system is exposed to automated scanning and opportunistic exploitation by unauthorized remote actors."
}