Syllabus Aligned Learning Management Examination System
Monthly
Cross-site request forgery in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows a remote unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerability stems from missing CSRF tokens on one or more application functions, as documented in a public exploit report filed under VULN-08-CSRF-Missing-Tokens. A proof-of-concept exploit is publicly available on GitHub, though no active exploitation has been confirmed by CISA KEV.
Cleartext storage of sensitive database credentials and user data in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 exposes plaintext secrets via the `cict_portal.sql` file. The SQL dump file, commonly placed within the web-accessible directory in SourceCodester PHP projects, can be retrieved directly over the network without authentication, leaking whatever credentials or personal data it contains. A public proof-of-concept exploit is available on GitHub, confirmed by VulDB and the referenced researcher report, raising the practical exploitation risk above what the moderate CVSS 4.0 score of 6.9 might suggest at first glance.
Session fixation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows unauthenticated remote attackers to pre-plant a session identifier via the auth_process.php login endpoint, then hijack the authenticated session after a victim logs in. The auth_process.php component fails to regenerate the session ID upon successful authentication, enabling full account takeover of any user who can be socially engineered into authenticating through a crafted link. A public exploit PoC exists on GitHub; no vendor patch has been released.
Cross-site scripting in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the msg, title, or content parameters in manage_subjects.php. A public proof-of-concept on GitHub documents both reflected and stored XSS variants, confirming the vulnerability is exploitable and the details are widely available. No vendor-released patch has been identified, and no active exploitation has been confirmed via CISA KEV.
Unauthenticated IDOR (Insecure Direct Object Reference) in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to delete arbitrary exam records by manipulating the `ID` parameter in `delete_exam.php` without any authorization check. Any network-accessible attacker can iterate over exam IDs to destroy examination data belonging to other users or system administrators. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for opportunistic abuse.
Hard-coded database credentials embedded in db.php of SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allow unauthenticated remote attackers to obtain and reuse valid database credentials without any prior authentication. The credentials, baked directly into the PHP source file, are exposed to any party who can read or retrieve that file over the network. Publicly available exploit code has been published per the VulDB submission and a GitHub vulnerability report covering the same product, elevating this beyond a theoretical risk.
Unauthenticated privilege escalation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to register as privileged users - including administrator - by manipulating the `role` parameter in the `register` function of `auth.php`. Because the application fails to enforce server-side role validation during self-registration, any unauthenticated user can tamper the role field to claim elevated privileges at account creation time. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation.
Cross-site request forgery in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows a remote unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerability stems from missing CSRF tokens on one or more application functions, as documented in a public exploit report filed under VULN-08-CSRF-Missing-Tokens. A proof-of-concept exploit is publicly available on GitHub, though no active exploitation has been confirmed by CISA KEV.
Cleartext storage of sensitive database credentials and user data in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 exposes plaintext secrets via the `cict_portal.sql` file. The SQL dump file, commonly placed within the web-accessible directory in SourceCodester PHP projects, can be retrieved directly over the network without authentication, leaking whatever credentials or personal data it contains. A public proof-of-concept exploit is available on GitHub, confirmed by VulDB and the referenced researcher report, raising the practical exploitation risk above what the moderate CVSS 4.0 score of 6.9 might suggest at first glance.
Session fixation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows unauthenticated remote attackers to pre-plant a session identifier via the auth_process.php login endpoint, then hijack the authenticated session after a victim logs in. The auth_process.php component fails to regenerate the session ID upon successful authentication, enabling full account takeover of any user who can be socially engineered into authenticating through a crafted link. A public exploit PoC exists on GitHub; no vendor patch has been released.
Cross-site scripting in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the msg, title, or content parameters in manage_subjects.php. A public proof-of-concept on GitHub documents both reflected and stored XSS variants, confirming the vulnerability is exploitable and the details are widely available. No vendor-released patch has been identified, and no active exploitation has been confirmed via CISA KEV.
Unauthenticated IDOR (Insecure Direct Object Reference) in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to delete arbitrary exam records by manipulating the `ID` parameter in `delete_exam.php` without any authorization check. Any network-accessible attacker can iterate over exam IDs to destroy examination data belonging to other users or system administrators. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for opportunistic abuse.
Hard-coded database credentials embedded in db.php of SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allow unauthenticated remote attackers to obtain and reuse valid database credentials without any prior authentication. The credentials, baked directly into the PHP source file, are exposed to any party who can read or retrieve that file over the network. Publicly available exploit code has been published per the VulDB submission and a GitHub vulnerability report covering the same product, elevating this beyond a theoretical risk.
Unauthenticated privilege escalation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to register as privileged users - including administrator - by manipulating the `role` parameter in the `register` function of `auth.php`. Because the application fails to enforce server-side role validation during self-registration, any unauthenticated user can tamper the role field to claim elevated privileges at account creation time. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation.