Executive brief
The SourceCodester Syllabus-Aligned Learning Management & Examination System is a web-based platform for educational institutions to manage courses, exams, and student enrollment. A cross-site request forgery vulnerability allows attackers to trick authenticated users into performing unauthorized actions such as deleting exams, modifying enrollments, or purging attendance records by embedding malicious links or forms on external websites.
Technical details
This is a cross-site request forgery (CSRF) vulnerability caused by missing anti-CSRF tokens and insufficient request validation in critical state-changing operations. The application lacks proper token-based protection on endpoints that modify exam records, student enrollments, and attendance data. Additionally, some operations use GET requests for state changes and do not validate the Referer or Origin headers. An unauthenticated attacker can craft a malicious webpage containing image tags or auto-submitting forms that, when visited by an authenticated user, trigger unwanted state changes in the application. No authentication bypass is required—the attacker leverages the user's existing session. Patches should implement anti-CSRF tokens, convert GET operations to POST, and enforce SameSite cookie attributes.
Affected products
- SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0
Timeline
- 2026-09-07: disclosed