Description

A vulnerability was detected in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This vulnerability affects the function register of the file auth.php. Performing a manipulation of the argument role results in improper privilege management. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T06:17:23.993Z",
  "pubdate": "2026-09-07T06:17:23.993Z",
  "executiveSummary": "A critical improper privilege management vulnerability exists in the SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0. The vulnerability resides within the registration functionality of the auth.php file. By manipulating the 'role' parameter during the account creation process, an unauthenticated remote attacker can successfully escalate their privileges to unauthorized levels, such as administrative access.\nThis vulnerability poses a significant security risk as it allows malicious actors to bypass standard registration constraints, potentially gaining full control over the application's learning management and examination features. The flaw stems from insufficient server-side validation of user-supplied input regarding account roles. Because the exploit is currently public, the likelihood of malicious exploitation is elevated. Successful exploitation requires no prior authentication and can be performed remotely over the network, making this an urgent security concern for deployments utilizing this software version.",
  "technicalDetails": "The vulnerability is classified as an improper privilege management flaw, specifically occurring within the user registration logic of the application. The root cause is the reliance on client-side input for critical authorization decisions without performing robust server-side verification. The vulnerable component is the 'register' function located within the 'auth.php' file.\nDuring the standard registration flow, the application accepts user input through an HTTP POST request. The application includes a 'role' parameter intended to define the user's access level within the system. Analysis reveals that the server-side code fails to sanitize or restrict this input, effectively trusting the value provided by the client. An attacker can intercept the registration request using a proxy tool and modify the 'role' parameter value from a standard user privilege (e.g., 'student') to a privileged role (e.g., 'admin' or 'administrator').\nUpon receiving the modified request, the backend application processes the registration and assigns the requested, elevated privilege level to the newly created account in the database. This bypasses the intended role-based access control (RBAC) mechanisms. Since the vulnerability is located in the public-facing 'auth.php' file, it requires no prior authentication or administrative oversight, allowing any remote user to self-provision an account with unauthorized elevated permissions.\nThe post-exploitation impact is severe. Once an attacker successfully creates an administrative account, they gain full access to the management and examination modules of the system. This allows the adversary to modify exam data, access sensitive student records, manipulate syllabus content, or perform further administrative actions that compromise the integrity and confidentiality of the entire Learning Management System. The lack of secondary verification or server-side mapping of allowed roles ensures that the injected parameter is accepted by the application layer, facilitating a seamless privilege escalation attack."
}