Onlne Examination LMS EUVD-2026-41733

The registration endpoint at register.php must be publicly accessible (i.e., open self-registration must be enabled, which is the default configuration for this type of platform). No authentication is required - the attack targets the account creation flow before any session is established. The role parameter must be accepted as a direct POST or GET input without server-side enumeration enforcement. Exploitation is limited to the application's own privilege domain; it does not provide OS-level or database-level access beyond what the application exposes to high-privileged roles. The attack is bounded to instances of version 1.0 of this specific product. Non-default deployments that disable public registration or perform server-side role validation would not be vulnerable.

The CVSS 4.0 base score of 5.5 is supported by a vector of AV:N/AC:L/AT:N/PR:N/UI:N with limited impact metrics (VC:L/VI:L/VA:L), which accurately reflects that exploitation is trivial and unauthenticated but impact is bounded to the application's own privilege domain rather than the underlying host. No EPSS data was provided in the intelligence feed, so exploitation probability cannot be quantified independently. The E:P threat metric in the CVSS 4.0 vector confirms a working public exploit exists, raising prioritization above pure base-score would suggest. The absence of a CISA KEV listing implies no confirmed mass or threat-actor-driven exploitation yet, but the combination of PR:N, AC:L, and public exploit code creates a low barrier for opportunistic abuse. The primary limiting factor is the product's narrow deployment footprint - SourceCodester distributes hobbyist and academic PHP scripts with limited enterprise adoption, reducing aggregate exposure significantly. The CVSS impact metrics (VC:L/VI:L/VA:L) appropriately reflect application-layer privilege gain rather than OS-level compromise; this is a meaningful but contained risk for any instance exposed to the internet.

An attacker visits the publicly accessible register.php endpoint and submits a crafted HTTP POST request with the role parameter set to a privileged value such as 'admin' or 'instructor'. The application inserts the attacker-supplied role directly into the user record without validation, granting the newly created account elevated privileges. The attacker then logs in with those credentials and gains access to administrative or privileged functionality - such as exam management, user administration, or grade modification - that should be restricted to trusted roles. A working proof-of-concept demonstrating this exact manipulation is publicly available on Pastebin.