Executive brief
SourceCodester's Syllabus-Aligned Learning Management & Examination System is a web-based learning platform used by educational institutions. Multiple functions lack proper access controls, allowing attackers to bypass authorization checks and perform sensitive actions such as deleting exams, approving enrollments, and accessing restricted lesson content without proper authentication.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) / broken access control flaw affecting multiple PHP files including delete_exam.php, approve_enrollment.php, download.php, edit_exam.php, take_exam.php, and view.php. The root cause is the absence of proper authorization checks before processing user-supplied parameters (primarily the ID argument). An attacker can remotely manipulate object references to perform unauthorized actions such as deleting other instructors' exams, approving or rejecting enrollments, downloading restricted content, and taking exams they are not enrolled in. The attack requires network connectivity but minimal or no authentication in some cases. No patch availability is confirmed in the advisory.
Affected products
- SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0
Timeline
- 2026-09-07: disclosed