Online Examination System EUVD-2026-103381

Exploitation targets the isAdmin() function in admin/admin.php, which fails to enforce authentication (CWE-306), so a remote attacker can reach administrative logic over the network without credentials or user interaction (AV:N/PR:N/UI:N). The practical limiting factor is reach and deployment: the affected Online-Examination-System must be network-accessible, and because it is a rolling-release hobby project with no versioning, defenders cannot pin an affected/fixed boundary and must verify the running code state directly. The vendor-assigned impact is confined to confidentiality (VC:L), so the condition for meaningful damage is that the exposed admin function discloses sensitive data rather than granting full control - this should be validated against the source since CWE-306 on an admin check often implies broader access.

Signals conflict on priority. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which sounds severe, but the vendor-assigned impact is deliberately narrow - only VC:L with VI:N/VA:N - yielding a MEDIUM 6.9. The exploit maturity sub-score E:P and the 'POC publicly available' signal agree that proof-of-concept code exists, but there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or widespread exploitation. This is characteristic of a VulDB-sourced disclosure against a small open-source GitHub project rather than an enterprise product under attack. A notable tension: CWE-306 (missing authentication) on an isAdmin() routine typically implies administrative access and therefore integrity/availability impact, yet the vendor scored only confidentiality-low - the real impact may be understated, so the VC:L/VI:N/VA:N breakdown should be verified against the source. Net assessment: a real but low-urgency issue - a published PoC against an obscure, student/hobby-grade examination application with negligible production footprint, not a high-real-risk priority despite the unauthenticated-network vector.

A remote, unauthenticated attacker sends a crafted request to admin/admin.php, where the isAdmin() function fails to enforce authentication, allowing access to administrative functionality without credentials. Public proof-of-concept detail exists (GitHub issue #4 referenced as the exploit), lowering the barrier to replication. Given AV:N/AC:L, the request can be issued directly over the network with no special tooling or user interaction.