EUVD-2026-41793
GHSA-vcp7-8j9c-m23x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable PHP endpoint with no auth gate (PR:N); IDOR yields partial read/write on enrollment records, no availability or scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management System 1.0. This affects an unknown part of the file /ajax_enroll.php of the component Enrollment Management. The manipulation of the argument student_id/schedule_id/action leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The name of the affected product appears to have a typo in it.
AnalysisAI
Improper authorization in SourceCodester Online Examination & Learning Management System 1.0 allows unauthenticated remote attackers to manipulate enrollment records by supplying arbitrary student_id, schedule_id, or action values to /ajax_enroll.php. The vulnerability is an Insecure Direct Object Reference (IDOR) - the application performs no ownership or privilege check before processing enrollment actions on behalf of any student. A public proof-of-concept has been disclosed (referenced by VulDB submission 850695 and GitHub advisory OE-LMS-IDOR-ajax_enroll.md); no active exploitation via CISA KEV has been confirmed at time of analysis.
Technical ContextAI
The affected component is /ajax_enroll.php within the Enrollment Management module of a PHP-based learning management system distributed by SourceCodester. CWE-266 (Incorrect Privilege Assignment) describes the root cause: the server-side logic accepts user-supplied object identifiers (student_id, schedule_id, action) and acts on them without verifying that the requesting party has authorization over those objects. This is a classic IDOR pattern - authorization is absent at the parameter level rather than merely bypassed. The application is PHP-based (per VulDB tags), typical of SourceCodester's open-source academic project portfolio. The CPE string is not formally published in NVD at time of analysis; affected version is confirmed as 1.0 by the description and vendor site (sourcecodester.com).
RemediationAI
No vendor-released patch or fixed version has been identified at time of analysis - the product is an open-source academic project and SourceCodester does not maintain a formal security advisory process. Operators running this system should immediately restrict access to /ajax_enroll.php by requiring session-level authentication and validating that the authenticated user's identity matches the student_id parameter before processing any enrollment action (server-side ownership check). As a compensating control, web application firewall rules can be applied to block unauthenticated or cross-origin requests to ajax_enroll.php, though this does not address the root authorization flaw. Restricting the application to internal networks or VPN-only access reduces remote exploitation exposure. Given that this is a SourceCodester demo-grade application not intended for production use, replacing it with a properly audited LMS is the recommended long-term action. Reference: https://github.com/nuiifornet/A033/blob/main/OE-LMS-IDOR-ajax_enroll.md.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today