Onlne Examination LMS CVE-2026-14775

Exploitation requires possession of a valid low-privilege application account, consistent with CVSS PR:L - in an LMS context this corresponds to a standard student or learner registration, which may be self-serviceable on open-enrollment instances. The /process_lesson.php endpoint must be network-accessible (AV:N) and no non-default configuration is required to trigger the flaw. Exploitation is bounded by the need for at least one authenticated session; unauthenticated exploitation is not supported by the PR:L CVSS metric. The additional prerequisite for full RCE - rather than mere arbitrary file storage - is that the server must store uploaded files in a web-accessible directory with PHP execution enabled; if the upload directory has php_flag engine off or is outside the web root, impact degrades to unauthorized file write rather than code execution.

The provided CVSS 4.0 score of 2.1 is inconsistent with the underlying vulnerability class and the evidence in the POC. The submitted vector assigns VC:L/VI:L/VA:L (low impact across all dimensions), yet the GitHub POC is explicitly titled 'OE-LMS-RCE-1,' framing the outcome as remote code execution - a discrepancy that represents a data quality concern and means the 2.1 score should not be used for prioritization. The confirmed metrics AV:N/AC:L/AT:N/PR:L/UI:N/E:P (exploit publicly available) describe a straightforward network-reachable attack requiring only a low-privilege account with no special conditions and a working public exploit. EPSS data was not provided; no KEV listing exists, which may reflect the narrow deployment footprint rather than low exploitability. Real-world risk is moderated by the fact that SourceCodester products are niche, hobbyist-grade PHP scripts with minimal enterprise deployment - organizations running this product in production should treat this as critical given the working POC.

An attacker holding a standard student account sends a crafted HTTP POST request to /process_lesson.php, embedding a PHP webshell as a lesson file upload while manipulating the user_id parameter. The server stores the file in a web-accessible directory without validating the file extension or MIME type, and the attacker retrieves it via a direct GET request, triggering server-side PHP execution and obtaining arbitrary OS command execution as the web server process user. A public proof-of-concept demonstrating this exact attack chain is available at https://github.com/nuiifornet/A033/blob/main/OE-LMS-RCE-1-process_lesson.md.