Barangay Resident Profiling EUVD-2026-64669

Exploitation requires possession of a valid low-privilege authenticated session in the application (PR:L per the CVSS 4.0 vector) - unauthenticated remote attackers cannot directly exploit this flaw without first obtaining credentials. The vulnerability is triggered by manipulating the ID parameter on the /boarders.php endpoint within the Boarder Management Module; no non-default configuration, special feature enablement, or specific platform variant is required beyond a standard PHP web server deployment. The primary limiting factor is the authentication prerequisite: access control hardening, multi-factor authentication, and minimizing the number of active accounts directly reduce exploitation risk. No specific operating system, web server version, or PHP version constraint has been identified in the available data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/E:P) characterizes this as a low-complexity, network-reachable attack requiring low privileges, with a public exploit already in circulation. No EPSS data was supplied, so probabilistic exploitation likelihood cannot be quantified from available inputs. The absence of a CISA KEV listing indicates no confirmed widespread exploitation campaign, though the GitHub PoC means opportunistic attackers need minimal capability once they hold credentials. Impact is deliberately scoped: VC:L/VI:L/VA:L reflects record-level data exposure and tampering rather than full system compromise or remote code execution, so the raw CVSS 4.0 score of 5.3 is broadly consistent with actual potential harm. Real-world risk is moderate for any active deployment - even a small barangay office running this system exposes personally identifiable information of residents to any malicious insider or compromised low-privilege account. The authentication prerequisite (PR:L) is the primary limiting factor; organizations that enforce strong credential hygiene and restrict account creation materially reduce exploitation likelihood. No conflicting signals between the CVSS vector and the description were identified.

An attacker with a standard low-privilege account logs into the Barangay Resident Profiling Management System and issues a crafted request to /boarders.php?id=<victim_record_id>, enumerating integer IDs to access or overwrite boarder records belonging to other residents without authorization. A public proof-of-concept demonstrating this technique is available at https://gist.github.com/c4ttr4ck/3601aa0ba9e567705823b6d425e84237, meaning successful exploitation requires minimal technical skill beyond possessing a valid account.