CVE-2026-14719 in Onlne Examination & Learning Management System
Summary
by MITRE • 07/05/2026
A flaw has been found in SourceCodester Onlne Examination & Learning Management System 1.0. The impacted element is an unknown function of the file register.php of the component Registration Endpoint. Executing a manipulation of the argument role can lead to improper privilege management. The attack can be executed remotely. The exploit has been published and may be used. The name of the affected product appears to have a typo in it.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/06/2026
This vulnerability resides within the SourceCodester Online Examination & Learning Management System version 1.0, specifically targeting the registration endpoint functionality implemented in register.php. The flaw manifests through an improper privilege management issue that stems from inadequate input validation and sanitization of the role parameter during user registration processes. The vulnerability represents a critical security weakness that allows attackers to manipulate the role argument to escalate their privileges beyond the intended access levels.
The technical implementation of this vulnerability falls under CWE-264, which addresses permissions, privileges, and access controls within software systems. Attackers can exploit this weakness by crafting malicious requests to the registration endpoint where they manipulate the role parameter to assume administrative or elevated user roles. This improper privilege management allows unauthorized users to gain access to restricted system functionalities that should only be available to legitimate administrators or privileged users. The attack vector is remotely exploitable, meaning no local access or authentication is required for successful exploitation.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it can lead to complete system compromise and unauthorized access to sensitive educational data including student records, examination materials, and learning management information. The vulnerability affects the core registration functionality of the LMS system, potentially allowing attackers to register themselves with administrative privileges or create accounts with elevated permissions. This weakness enables adversaries to perform actions such as modifying user roles, accessing restricted administrative interfaces, manipulating examination content, and compromising the integrity of the entire learning management ecosystem.
Remote exploitation of this vulnerability means that attackers can leverage publicly accessible web interfaces without requiring physical access to the system infrastructure. The fact that an exploit has been published and is potentially available for use significantly increases the risk profile of affected systems, as it removes the requirement for advanced technical skills in developing custom attack vectors. Organizations should immediately assess their deployment of this software and implement mitigations including input validation, role-based access controls, and proper parameter sanitization to prevent unauthorized privilege escalation.
The vulnerability demonstrates poor security implementation practices that violate fundamental security principles such as least privilege and input validation. Security controls should enforce strict validation of user inputs, particularly parameters that influence system behavior or access control decisions. Organizations should consider implementing additional protective measures including web application firewalls, input filtering mechanisms, and regular security audits to identify similar weaknesses in other components of their systems.
This particular vulnerability represents a classic case of insecure privilege management that could be addressed through proper implementation of role-based access controls and robust parameter validation. The affected system should undergo comprehensive security review to identify additional potential weaknesses in the authentication and authorization mechanisms. Organizations utilizing this software must prioritize patching or implementing compensating controls immediately, as the published exploit availability makes this vulnerability particularly dangerous for unpatched systems. The incident underscores the critical importance of proper access control implementation and input sanitization in web applications, particularly those handling sensitive educational data and user credentials.