Description

A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php of the component User Creation. Performing a manipulation of the argument position results in missing authentication. The attack may be initiated remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T10:16:55.230Z",
  "pubdate": "2026-09-07T10:16:55.230Z",
  "executiveSummary": "The SourceCodester Simple Traffic Offense System 1.0 contains a critical authentication bypass vulnerability within the User Creation component.\nThe flaw originates from improper input handling in the saveuser.php file, specifically targeting the position argument.\nThis vulnerability allows unauthenticated, remote attackers to perform unauthorized user creation actions, effectively bypassing security controls meant to protect administrative functions.\nThe risk implication is high, as the lack of authentication mechanisms permits the unauthorized injection of accounts into the system, which can lead to full application compromise, privilege escalation, or unauthorized data access.\nAs a publicly documented exploit, the barrier to entry for malicious actors is significantly lowered, necessitating immediate remediation to prevent unauthorized system access.",
  "technicalDetails": "The vulnerability resides within the saveuser.php script, which is responsible for processing user registration or account creation requests within the Simple Traffic Offense System 1.0.\nTechnical analysis indicates that the application fails to enforce session-based or role-based access control checks before executing the logic contained within saveuser.php.\nThe root cause of the flaw is the improper validation and authentication enforcement tied to the position argument. By manipulating this specific parameter during the POST or GET request submission to the server, an external attacker can bypass the intended access requirements.\nThe attack flow commences when a remote, unauthenticated user submits a crafted HTTP request to the vulnerable saveuser.php endpoint. By supplying specific values for the position argument, the attacker triggers the backend logic responsible for user creation without presenting a valid session token or administrative privilege credentials.\nThe application logic fails to verify the requestor's identity before interacting with the underlying database to create a new record. Consequently, the system processes the unauthorized request as a legitimate administrative action.\nThe exploitation of this flaw does not require prior knowledge of legitimate user credentials or complex bypass techniques, as the authentication barrier is effectively absent for this specific function.\nPost-exploitation, an attacker can successfully instantiate a new user account with elevated privileges, depending on the role mappings accepted by the vulnerable function. This facilitates further malicious activity, such as unauthorized data modification, system configuration changes, or complete takeover of the traffic offense management database.\nThe lack of server-side authentication checks within the file structure constitutes a significant design failure in the component's architecture, as security logic is decoupled from the operational function it is intended to protect."
}