SourceCodester LMS CVE-2026-86277

No special conditions are required beyond network reachability to the web application. The CVSS 4.0 vector PR:N/UI:N indicates exploitation requires neither authentication nor user interaction. The endpoint delete_exam.php accepts an integer ID parameter via HTTP request; no session cookie, CSRF token, or privileged role is validated server-side. Exploitation is limited to: (1) the target instance being network-accessible (local network or internet-exposed); (2) the application running PHP on a web server - a default deployment state. The only natural constraint is that the attacker must be able to reach the application's web port. Valid exam IDs are likely sequential integers starting from 1, making enumeration trivial without prior knowledge.

The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N) accurately captures the low-friction, network-accessible nature of exploitation: no authentication, no complexity, no user interaction. The E:P supplemental metric confirms a public exploit exists, which materially elevates near-term risk. Impact metrics are correctly bounded at Low across CIA - the direct harm is deletion of exam data rather than full system compromise or credential exposure. EPSS data is not provided, but given the niche footprint of SourceCodester demo applications (predominantly used in academic settings in developing regions), widespread scanning-based exploitation is unlikely. The realistic threat is targeted sabotage - a student or adversary deleting exams during an active examination period - rather than mass automated compromise. No KEV listing, so confirmed active exploitation is not established.

An attacker with network access to the application - such as a student enrolled on the same platform - sends a series of HTTP GET or POST requests to delete_exam.php?ID=1, ?ID=2, etc., iterating over sequential integer IDs. Because no authentication or authorization is enforced, each request successfully deletes the target exam record. A public PoC (GitHub: hackliu/Vulnerability-Reports, VULN-04-IDOR-Broken-Access-Control.md) documents the exact request format, enabling script-kiddie-level exploitation.