Executive brief
SourceCodester Simple Traffic Offense System is a web-based application for managing traffic offenses and user accounts. The system fails to authenticate deletion requests, allowing attackers to remotely delete user accounts and offense records without logging in, resulting in unauthorized data loss and system integrity compromise.
Technical details
The application contains a critical authentication bypass in the delete-user.php and delete-offence.php endpoints. Both endpoints accept GET requests with an id parameter and perform destructive record deletion without validating server-side authentication or authorization. An unauthenticated attacker can craft a direct GET request to these endpoints (e.g., /Trafic/delete-user.php?id=1) and successfully delete records even without a valid session cookie. The vulnerability stems from missing CWE-306 (missing authentication for critical function) and CWE-862 (missing authorization) controls. An attacker needs only network access and knowledge of valid record IDs; no authentication or user interaction is required. The exploitation results in unauthorized deletion of user accounts and offense data.
Affected products
- SourceCodester Simple Traffic Offense System 1.0
Timeline
- 2026-07-27: disclosed: Vulnerability disclosed on GitHub
- 2026-09-07: advisory: CVE-2026-86293 published