Description

A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument ID can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T10:16:55.407Z",
  "pubdate": "2026-09-07T10:16:55.407Z",
  "executiveSummary": "The Simple Traffic Offense System 1.0 contains a critical authentication bypass vulnerability located within the delete-user.php script.\nThis flaw involves an improper implementation of access control mechanisms within the application's deletion endpoint, allowing unauthorized remote actors to trigger the deletion of system users.\nThe vulnerability is classified as a missing authentication flaw, which allows for the arbitrary removal of administrative or standard user accounts without requiring valid session credentials.\nDue to the nature of the vulnerability, an attacker can launch the exploit remotely over the network with minimal effort, as the application fails to verify the requester's identity or authorization level prior to executing the deletion routine.\nThe risk implication is severe, as successful exploitation can lead to a complete denial of service for legitimate users, account lockout, and the potential disruption of administrative system functions.\nThe vulnerability is currently known to be exploitable, with exploit code available publicly, necessitating immediate remediation to prevent unauthorized system modification.",
  "technicalDetails": "The vulnerability originates in the delete-user.php file, which serves as the endpoint for processing user account removals within the Simple Traffic Offense System 1.0.\nThe root cause is identified as an authorization bypass where the application fails to enforce authentication checks or session validation before executing logic that interacts with the user database.\nSpecifically, the script accepts an ID parameter via an HTTP request. The application processes this ID to identify the record for deletion without verifying if the user initiating the request possesses the necessary administrative privileges or has an active, authenticated session.\nThe attack flow proceeds as follows: An unauthenticated remote attacker identifies the target URL for the delete-user.php endpoint. By crafting a malicious HTTP request—typically a GET or POST request containing the target's unique identifier in the ID parameter—the attacker forces the server to execute the deletion logic.\nSince the application does not validate the sender's security context, the server-side script executes the SQL command or function responsible for removing the specified entry from the underlying database.\nThe lack of server-side input validation and authentication checks means the system essentially trusts the ID parameter blindly. An attacker can enumerate or guess the IDs of system users, potentially leading to the systematic deletion of all users within the application.\nThis vulnerability is classified as remote because the endpoint is accessible via standard network protocols (HTTP/HTTPS) without restriction. The impact post-exploitation includes unauthorized account deletion, loss of data integrity, and significant administrative disruption.\nThe exploit behavior is characterized by direct interaction with the vulnerable endpoint; because there are no middleware or session-check wrappers implemented around the delete-user.php logic, the attacker avoids all traditional credential challenges."
}