提交 #997820: Fabian Ros (Code-Projects) Online Reviewer System 1.0 Privilege Escalation / Broken Access Control / Mass Assignment

A critical vulnerability exists in the "Online Reviewer System v1.0" that allows low-privileged users, such as Students or Teachers, to escalate their privileges to Administrator. The application suffers from Missing Function Level Access Control and Mass Assignment within the user profile update endpoint located at /reviewer/system/system/admins/manage/users/btn_functions.php. The backend fails to verify the authorization level of the user initiating the request. An attacker can manipulate the HTTP POST request by injecting the usertype_id=1 parameter. The application blindly accepts this unvalidated input and directly updates the current user's role in the database, granting them full administrative access. This allows the attacker to gain full control over the system's backend, including managing exams and modifying other users' accounts.

-----------------------------------------
* NOTES FOR CNA ADMIN REGARDING PREREQUISITES *
1. Vendor Contact: This is an community project from Code-Projects. There is no valid security contact, email, or active support channel available to reach the developer. Due to this limitation, the vulnerability has been publicly disclosed on GitHub.
2. Previous CNA Submission: I originally submitted this vulnerability to MITRE (Ticket ID: 2103715 ) 15 days ago. As there has been no response and the vulnerability details have been publicly available on my GitHub repository for 2 weeks, I am requesting a CVE assignment via VulDB to ensure timely processing.I have already sent an email to withdraw the MITRE request to prevent any duplication."

• 来源: ⚠️ https://github.com/thuong2206/Online-Reviewer-System-Privilege-Escalation
• 用户: thuong2206 (UID 101615)
• 提交: 2026-09-24 17時03分 (18 日前)
• 管理: 2026-10-11 21時03分 (17 days later)
• 状态: 已接受
• VulDB条目: 416772 [code-projects Online Reviewer System 1.0 User Profile Update btn_functions.php usertype_id]
• 积分: 20