Simple Traffic Offense System
Monthly
Cross-site scripting in SourceCodester Simple Traffic Offense System 1.0 allows remote attackers to inject arbitrary JavaScript via the site_name and site_desc parameters of the save-settings.php Settings Update Endpoint. The injected payload is stored server-side and executes in the browser of any user who subsequently loads the affected page. A public proof-of-concept exploit has been disclosed on GitHub (issue #3 in tan1540684326-QAQ/cve), confirming the vulnerability is reproducible.
Unauthenticated remote user deletion is possible in SourceCodester Simple Traffic Offense System 1.0 via the delete-user.php endpoint, which processes a user-supplied ID parameter without any session or privilege check. An attacker with HTTP access to the application can delete arbitrary user accounts without logging in, impacting data integrity and application availability. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified at time of analysis applies to KEV only - PoC is confirmed); the vulnerability is not listed in CISA KEV.
Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest.
Cross-site scripting in SourceCodester Simple Traffic Offense System 1.0 allows remote attackers to inject arbitrary JavaScript via the site_name and site_desc parameters of the save-settings.php Settings Update Endpoint. The injected payload is stored server-side and executes in the browser of any user who subsequently loads the affected page. A public proof-of-concept exploit has been disclosed on GitHub (issue #3 in tan1540684326-QAQ/cve), confirming the vulnerability is reproducible.
Unauthenticated remote user deletion is possible in SourceCodester Simple Traffic Offense System 1.0 via the delete-user.php endpoint, which processes a user-supplied ID parameter without any session or privilege check. An attacker with HTTP access to the application can delete arbitrary user accounts without logging in, impacting data integrity and application availability. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified at time of analysis applies to KEV only - PoC is confirmed); the vulnerability is not listed in CISA KEV.
Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest.