Improper Privilege Management in Online Examination & Learning Management System

Executive Summary

CVE-2026-14719 is an improper privilege management vulnerability in the SourceCodester Online Examination & Learning Management System. It occurs because the system accepts a user-supplied 'role' parameter during registration without proper server-side validation. This allows an unauthenticated attacker to manipulate the role value and escalate their privileges to super_admin by injecting a malicious role parameter.

The affected files include register.php, auth.php, and auth_process.php. The vulnerability enables attackers to bypass the intended HTML dropdown role selection and set any role via a POST request, effectively granting unauthorized administrative access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive data, manipulation of grades, and the creation of persistent admin accounts by attackers. Since attackers can escalate their privileges to super_admin without authentication, they can access admin-only pages and perform actions reserved for administrators.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for POST requests to the registration endpoint (register.php) that include a role parameter with values other than the intended 'student'. Attackers exploit this by injecting a malicious role value to escalate privileges.

A practical detection method is to inspect web server logs or use network monitoring tools to identify suspicious POST requests containing the role parameter.

• Use command-line tools like grep to search web server logs for POST requests with the role parameter, for example: grep "role=" /var/log/apache2/access.log
• Use curl to simulate a malicious registration attempt: curl -X POST -d "username=test&password=test&role=super_admin" http://target/register.php -v
• Deploy web application firewalls (WAF) or intrusion detection systems (IDS) to alert on POST requests with unexpected role values.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include hardcoding the role parameter to 'student' for all self-registrations and removing the role dropdown from the registration page to prevent users from selecting or injecting arbitrary roles.

Additionally, restrict role assignment functionality to authenticated admin panels only, ensuring that only authorized administrators can assign elevated privileges.

Review and update the server-side code (especially auth_process.php and register.php) to validate or ignore any role parameter coming from user input.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated users to escalate privileges to super_admin, leading to unauthorized access to sensitive data and manipulation of grades.

Such unauthorized access and data manipulation can result in violations of data protection and privacy regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.

Failure to properly manage privileges and protect sensitive data could lead to non-compliance with these standards, potentially resulting in legal and financial consequences.

Useful 0 Not Useful 0