Description

A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. Impacted is an unknown function of the file delete_exam.php. The manipulation of the argument ID leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T07:16:47.620Z",
  "pubdate": "2026-09-07T07:16:47.620Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in the Syllabus-Aligned Learning Management & Examination System 1.0. This security flaw exists within the delete_exam.php file, allowing unauthorized remote actors to execute sensitive administrative functions.\nThe vulnerability is classified as an improper access control issue. By manipulating the ID parameter, an unauthenticated or low-privileged attacker can successfully delete examinations from the system without verifying session integrity or user permissions.\nThe risk implication is severe, as the integrity and availability of the learning management system are directly threatened. Successful exploitation results in data destruction, specifically the unauthorized removal of exam records.\nGiven that the exploit is publicly disclosed, the system is exposed to active exploitation attempts. No specific authentication is required to interact with the vulnerable endpoint, lowering the barrier to entry for potential attackers. Organizations utilizing this version are at immediate risk of administrative function abuse.",
  "technicalDetails": "The vulnerability resides in the server-side processing logic of delete_exam.php within the Syllabus-Aligned Learning Management & Examination System 1.0. The root cause is a failure to implement robust server-side authorization checks when processing requests to modify or delete database records.\nThe application relies on a client-supplied ID parameter to identify which exam record should be removed from the backend database. Analysis indicates that the script fails to validate whether the requester possesses the appropriate session-based permissions or administrative privileges required to invoke a destructive action. Consequently, the script processes the deletion command based solely on the presence of the ID argument.\nThe attack flow proceeds as follows: 1) The attacker identifies the target endpoint, delete_exam.php. 2) The attacker crafts an HTTP request, typically a GET or POST request, targeting this file. 3) The attacker injects a target integer or string value into the ID parameter corresponding to the exam ID intended for deletion. 4) The server-side code receives the request and executes the corresponding database query—likely a SQL 'DELETE' statement—using the user-supplied ID without verifying if the user is authorized to perform this action. 5) The system confirms the deletion, often returning a success message or redirecting, thereby finalizing the unauthorized operation.\nThis vulnerability is classified as an authorization bypass because the application assumes that only legitimate administrators will access the file, failing to enforce mandatory access control (MAC) or role-based access control (RBAC) at the function level. Since the exploit is executable remotely, any network-adjacent or external actor with knowledge of the endpoint path can trigger the logic. The lack of an anti-CSRF token or proper session token validation further exacerbates the vulnerability, as the application cannot distinguish between a legitimate request and a malicious one.\nPost-exploitation impact includes the permanent loss of examination data, which can disrupt educational processes and compromise the reliability of the examination environment. Because the system lacks defensive wrappers around its deletion logic, the exploit is straightforward and highly effective against the 1.0 version of the platform."
}