Executive brief
SourceCodester Class and Exam Timetabling System is a web application for managing class schedules and exams. An authenticated low-privileged user can modify any other user's account, including the administrator, by bypassing authorization checks on the password update functionality. An attacker with a standard CIT user account can take over the entire application by resetting the administrator password.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the password update functionality at /admin/edit_user_account.php. The application authenticates the user's session but fails to verify whether the authenticated user has permission to modify the target account specified by the id parameter. An authenticated CIT user can craft a POST request targeting any account (e.g., id=4 for admin) and the server will process it without authorization validation. This allows privilege escalation from a low-privileged role to administrator by resetting the admin password. The attack requires valid authentication credentials but no elevated privileges, and is exploitable via network access to the application.
Affected products
- SourceCodester Class and Exam Timetabling System 1.0
Timeline
- 2026-08-23: disclosed