EUVD-2026-72324
GHSA-jvx9-crv4-28cj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed Simple Traffic Offense System instance
-
ExploitSend unauthenticated HTTP request to delete-user.php with target ID
-
ExecutionServer executes deletion without session check
-
ImpactArbitrary user account deleted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions required - the vulnerable delete-user.php endpoint is accessible to any HTTP client that can reach the web server, with no authentication, session token, or privileged role needed. The only limiting factor is network reachability: if the application is deployed behind a firewall restricted to trusted internal hosts, remote exploitation is blocked. Exploitation is constrained to deletion of user records only; the endpoint does not expose confidentiality of existing data through this flaw. Affects PHP deployments of Simple Traffic Offense System 1.0 regardless of web server configuration, as the missing check is in application code, not infrastructure. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a trivially exploitable network-accessible flaw: no authentication, no complexity, no special conditions, no user interaction. The E:P modifier confirms PoC code is publicly available, lowering the bar for exploitation further. However, the impact metrics (VC:N/VI:L/VA:L) constrain real-world severity - the attacker can delete user records but cannot read sensitive data through this specific endpoint. No KEV listing indicates no confirmed widespread active exploitation, consistent with the product's niche academic deployment footprint. Real-world risk is primarily to organizations that have inadvertently deployed this application on internet-facing infrastructure, which is plausible given SourceCodester's audience. EPSS is not provided but would be expected to be low given the obscure product. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies an internet-exposed instance of Simple Traffic Offense System 1.0 and submits an HTTP request to delete-user.php with an arbitrary integer ID parameter. The server processes the deletion without validating session state, removing the targeted user account from the database. The GitHub-hosted PoC demonstrates this technique directly, requiring no special tooling beyond a web browser or curl. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Unauthenticated remote user deletion is possible in SourceCodester Simple Traffic Offense System 1.0 via the delete-user.php endpoint, which processes a user-supplied ID parameter without any session or privilege check. An attacker with HTTP access to the application can delete arbitrary user accounts without logging in, impacting data integrity and application availability. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified at time of analysis applies to KEV only - PoC is confirmed); the vulnerability is not listed in CISA KEV.
RemediationAI
No vendor-released patch has been identified at time of analysis. As an immediate compensating control, restrict access to delete-user.php at the web server layer - for Apache, add a Require valid-user directive in a Location block; for Nginx, add an auth_basic gate or IP allowlist. The trade-off is that this requires a separate credential store. Alternatively, modify delete-user.php directly to insert a session authentication check at the top of the script, verifying the requesting user is authenticated and holds an admin role before processing any deletion. Deployers should consider taking the application offline entirely if it is exposed to untrusted networks and no immediate fix is possible. See VulDB entry https://vuldb.com/vuln/399455 and PoC at https://github.com/tan1540684326-QAQ/cve/issues/2 for technical detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a PHP-based web application distributed by SourceCodester, a platform providing free academic and hobby-grade source code (CPE: cpe:2.3:a:sourcecodester:simple_traffic_offense_system:*:*:*:*:*:*:*:*). The root cause is CWE-306 (Missing Authentication for Critical Function): the delete-user.php script accepts a user ID via a request parameter and executes the corresponding deletion directly, with no session validation, role check, or CSRF token enforcement before the destructive database operation is performed. This exposes a state-modifying action over HTTP to any unauthenticated client.
Know when Simple Traffic Offense System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-exploitable with no auth (PR:N); deletion-only impact gives I:L and A:L but no confidentiality exposure (C:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument ID can lead to missing authentication. The attack may be launched remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to cr
Cross-site scripting in SourceCodester Simple Traffic Offense System 1.0 allows remote attackers to inject arbitrary Jav
Exploit-DB