SourceCodester HRMS CVE-2026-108972

No special conditions - remote unauthenticated exploitation against a default deployment of SourceCodester Human Resource Management System 1.0, by sending manipulated role/pfimg/EmpId parameters to the Employee Endpoint (controller/employee.php), where session_start improperly establishes the authenticated session. The only practical limiting factor is reachability: the target instance must be network-accessible to the attacker. No authentication, no user interaction, and no non-default configuration are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Signals are mixed. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores only 5.5 (medium) because NVD rates impact as low across the board (VC:L/VI:L/VA:L), and the E:P flag denotes proof-of-concept maturity rather than active exploitation. However, the primary reference (tracexlabs 'hrm-10-preauth-admin-takeover') explicitly claims a pre-authentication ADMIN TAKEOVER, which would justify high confidentiality and integrity impact - this directly conflicts with NVD's low impact rating and should be verified with the researcher/vendor. No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation; the accurate status is that publicly available exploit code exists (POC - confirmed both by the 'exploit has been made public' note and the E:P metric). No SSVC decision data (exploitation status, automatable, technical impact) was provided. Net read: the underlying weakness is serious (unauthenticated remote authentication bypass via parameter manipulation, CWE-287), but real-world priority is tempered by the product's negligible deployment footprint - a low-prevalence hobby/tutorial application - so despite POC availability this is more likely opportunistic scanning fodder than a widespread enterprise emergency.

A remote, unauthenticated attacker sends a crafted request to the Employee Endpoint (controller/employee.php), manipulating the role, pfimg, and/or EmpId parameters so that session_start establishes an authenticated session with elevated privileges, consistent with the referenced pre-auth admin-takeover write-up. A public exploit exists, lowering the skill barrier. Because no authentication or user interaction is required (PR:N/UI:N), any internet-reachable instance can be targeted directly.