Executive brief
The Syllabus-Aligned Learning Management & Examination System is a web-based educational platform used for course management and student examinations. An unauthenticated attacker can manipulate user registration parameters to assign themselves elevated administrative privileges, allowing them to bypass authentication and gain full control of the system and all student/faculty data.
Technical details
The vulnerability is an improper privilege management flaw in the registration function of auth.php. The root cause is insufficient validation of the role parameter during user registration, allowing an attacker to set arbitrary privilege levels without authentication. The attack is network-accessible and requires no prior authentication or user interaction—an attacker can directly craft a registration request with an elevated role value (e.g., admin) to gain administrative access. This enables complete system compromise including unauthorized access to student records, grades, and examination data. No patch is currently available; remediation requires input validation and role-based access control enforcement in the registration handler.
Affected products
- SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0
Timeline
- 2026-09-07: disclosed