CVE-2025-14206
BaseFortify
Publication date: 2025-12-08
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | online_student_clearance_system | 1.0 |
| senior-walter | online_student_clearance_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the SourceCodester Online Student Clearance System 1.0, specifically in the /Admin/delete-fee.php file within the Fee Table Handler component. By manipulating the ID argument, an attacker can perform improper authorization, potentially allowing unauthorized actions. The attack can be executed remotely and the exploit has been publicly disclosed.
How can this vulnerability impact me? :
The vulnerability can lead to improper authorization, which means an attacker could perform actions they are not permitted to do, such as deleting or modifying fee records. This can compromise the integrity and availability of the system's data and operations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for unauthorized access attempts to the URL /Admin/delete-fee.php with an ID parameter. You can monitor web server logs for requests to /Admin/delete-fee.php?id= followed by any value. Additionally, using Google dorking with queries like "inurl:Admin/delete-fee.php" can help identify exposed vulnerable endpoints. On your system, you can use commands like `grep 'delete-fee.php?id=' /var/log/apache2/access.log` (or the equivalent log file) to find suspicious access attempts. Monitoring for DELETE SQL queries without proper authentication in application logs can also help detect exploitation attempts. [2, 1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing strict authentication and authorization checks at the start of the /Admin/delete-fee.php script to ensure that only authenticated users with appropriate administrative privileges can perform deletion operations. This prevents unauthorized users from invoking the deletion functionality. If possible, replace the affected component with an alternative product that does not have this vulnerability. Additionally, restrict access to the /Admin directory via web server configuration to trusted users only. [1, 3, 2]