| शीर्षक | SourceCodester (ampoldev) Online Examination & LMS (CICT Portal) by ampoldev 2026-05-25 Improper Privilege Management |
|---|
| विवरण | The public registration form at register.php renders an HTML <select> dropdown with role
values (student, instructor). The server-side handler (auth_process.php) reads the role
value directly from the POST body and inserts it into the users table without validation.
An unauthenticated attacker can intercept the POST request and change the role parameter
to any value, including "super_admin", gaining immediate administrative access to the
entire system.
No server-side allowlist is enforced. The vulnerability requires zero existing privileges
and is exploitable by any internet user who can reach the registration endpoint. |
|---|
| स्रोत | ⚠️ https://pastebin.com/Z4i5MGxk |
|---|
| उपयोगकर्ता | ameenkbrd (UID 98192) |
|---|
| सबमिशन | 04/06/2026 08:56 AM (1 महीना पहले) |
|---|
| संयम | 04/07/2026 09:55 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 376307 [SourceCodester Onlne Examination & Learning Management System 1.0 Registration Endpoint register.php role अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|