CVE-2026-75151 in Onlne Examination & Learning Management System
Summary
by MITRE • 08/18/2026
A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The identified security flaw resides within the SourceCodester Online Examination and Learning Management System version 1.0, specifically affecting an unspecified functional component of the application architecture. This vulnerability is classified as a Cross-Site Request Forgery, commonly referred to by its acronym CSRF or XSRF. The core technical deficiency lies in the absence of robust anti-CSRF mechanisms within the affected functionality. Typically, web applications rely on unique, unpredictable tokens embedded in forms and validated upon submission to ensure that requests originate from legitimate users interacting with the site directly. In this instance, the system fails to implement such verification processes for at least one critical operation, allowing an attacker to craft malicious HTTP requests that mimic valid user actions without requiring authentication cookies or session identifiers if they are not properly scoped or protected by SameSite cookie attributes.
From a technical perspective, the exploitation of this vulnerability requires no prior knowledge of the victim's credentials beyond what is already present in their active browser session during normal usage. An attacker can initiate the attack remotely by hosting a malicious webpage or embedding it within an email or social media post. When a logged-in administrator or user with elevated privileges visits this malicious page, their browser automatically includes any associated authentication cookies for the target domain due to standard HTTP behavior. The forged request is then sent to the vulnerable endpoint of the Learning Management System, which processes it as if it were initiated by the legitimate user because it lacks the necessary token validation step. This bypasses server-side authorization checks that rely solely on session state rather than explicit intent verification through tokens or custom headers.
The operational impact of this vulnerability is significant depending on the privileges associated with the affected functionality within the examination and learning management system. If the vulnerable endpoint allows for administrative actions, such as modifying user roles, changing course configurations, deleting exam data, or altering grading parameters, an attacker could manipulate these settings to disrupt educational operations or steal sensitive academic information. For example, a successful CSRF attack might allow an adversary to reset passwords of other users, enroll unauthorized individuals into courses, or delete critical examination records. This leads to integrity violations where the system cannot distinguish between legitimate administrative decisions and maliciously induced changes, potentially resulting in data loss, service disruption, or further exploitation vectors if combined with other vulnerabilities like stored cross-site scripting.
This vulnerability aligns closely with CWE-352, which defines Cross-Site Request Forgery as a weakness allowing an attacker to send unauthorized commands to a web application on behalf of a authenticated user. It also maps to the MITRE ATT&CK framework under technique T1076, specifically Remote File Inclusion or similar execution methods depending on how the forged request is delivered and what action it triggers, though more accurately it falls under social engineering tactics used in conjunction with browser-based attacks like T1553. The lack of proper state change protection indicates a failure to adhere to OWASP Top 10 guidelines regarding broken access control and insufficient validation of user input context.
To mitigate this vulnerability, developers must implement anti-CSRF tokens for all state-changing HTTP requests, particularly those involving administrative functions or sensitive data modifications. These tokens should be unique per session and validated server-side before processing any request that alters system state. Additionally, implementing the SameSite attribute on cookies set to Strict or Lax can prevent browsers from sending them in cross-site contexts, thereby reducing the attack surface significantly. Input validation alone is insufficient for CSRF prevention as it does not verify the origin of the request intent; therefore, combining token-based verification with secure cookie attributes and potentially requiring re-authentication for high-risk operations provides a defense-in-depth strategy against such forgery attacks.