SourceCodester LMS CVE-2026-86280

Exploitation requires the cict_portal.sql file to be present in a web-accessible directory and retrievable over HTTP without authentication - a common condition in default SourceCodester deployments where users import the SQL file from within the web root without subsequently removing it. No authentication is required against the application itself; the attacker bypasses the application entirely by directly requesting the SQL file. Exploitation is limited to deployments where the SQL file has not been deleted post-install, and where no web-server-level access controls (deny rules, authentication gates) restrict access to .sql files. Platforms deploying the system behind a VPN or non-public network are protected by that network boundary.

The CVSS 4.0 score of 6.9 with the E:P (exploit proof-of-concept) supplemental metric accurately characterizes the risk tier: this is not a theoretical weakness but one with a published researcher writeup and GitHub-hosted PoC. The attack vector is network (AV:N), complexity is low (AC:L), and no privileges or user interaction are required - the primary limiting factor is whether the SQL file is actually reachable via HTTP, which depends on server configuration. KEV status is negative, so no confirmed active mass exploitation is on record; however, given that SourceCodester projects are often deployed as-is without hardening by students or academic IT departments, the likelihood of misconfiguration leaving the SQL dump web-accessible is non-trivial. Even a hypothetical small-to-mid-sized educational institution in inowroclaw running this system on a shared host would face immediate credential exposure if the dump file sits in the web root. EPSS data was not provided, but the combination of public PoC, low complexity, and common deployment misconfigurations in this product category suggests real-world exploitation probability is higher than the score alone conveys.

An attacker scans for exposed SourceCodester application directories using common web paths and discovers the cict_portal.sql file is directly downloadable via HTTP. They retrieve the SQL dump, extract plaintext admin credentials from the INSERT INTO statements, and use those credentials to log into the LMS admin panel or any other system sharing the same password. A public PoC on GitHub documents the exact file path and field locations, making this trivially reproducible.