Improper Authorization in Class and Exam Timetabling System User Account Update

Executive Summary

This is a privilege escalation vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The application fails to enforce proper authorization checks when handling password update requests. An authenticated low-privileged user can exploit this by sending a modified password update request to change another user's password, including the administrator account, using their own valid session.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to /admin/edit_user_account.php for unauthorized password update attempts. Check server logs for requests modifying user IDs (e.g., targeting ID 4 for admin) from low-privileged accounts. Use tools like Burp Suite or Wireshark to inspect traffic for crafted requests.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a valid low-privileged account can reset the administrator password, gain administrative access, and perform actions with elevated privileges. This could lead to full compromise of the application's confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, unauthorized modifications, or system disruptions, potentially leading to non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Implement server-side authorization checks for password updates. Ensure requests use the authenticated session identity and ignore client-supplied user IDs. Restrict admin password changes to authorized roles only. Monitor and log all password change events for anomalies.

Useful 0 Not Useful 0