Executive brief
The Simple Traffic Offense System is a PHP-based web application used to manage traffic violations and offenses. An unauthenticated attacker can bypass authentication checks in the user creation function, modify a role parameter, and create a new administrator account—giving them full control over the application and access to all stored offense and driver data.
Technical details
The vulnerability is an authentication bypass (CWE-306) and privilege escalation (CWE-862, CWE-269) in the saveuser.php endpoint. The vulnerable component fails to enforce server-side authentication or authorization checks before processing account creation requests. An attacker can delete their session cookie or craft a direct request to saveuser.php without an authenticated session, modify the "position" parameter to "admin", and the server will accept the request and create a new administrator account. The root cause is that the application relies on client-side form controls and session validation at the UI level only, not at the backend. There are no confirmed fixes at the time of this advisory; the vulnerability affects version 1.0 and the application is available on SourceCodester.
Affected products
- SourceCodester Simple Traffic Offense System 1.0
Timeline
- 2026-07-27: disclosed
- 2026-09-07: advisory