Unauth LMS Privilege Escalation: Missing Server-side Role Validation in auth.php (CVSS 9.8)

VULN-01 Key Vulnerability Information Summary 1. Vulnerability Overview Vulnerability Name: Unauthenticated Privilege Escalation via Unprotected Registration Affected System: Syllabus-Aligned Learning Management & Examination System (CICT Portal) Affected Version: 1.0 Severity: CRITICAL (CVSS v3.1 Score 9.8) CWE: CWE-269 (Improper Privilege Management) Affected Components: / Date Discovered: 2026-07-25 CVSS Vector: Root Cause: The registration endpoint directly accepts the user-supplied parameter without server-side validation. Attackers can bypass the front-end dropdown restrictions and, via a direct POST request, set to , thereby gaining full system administration privileges. 2. Impact Scope Total System Compromise: The attacker obtains privileges and can fully control the system. Data Exposure: Can access all student transcripts, grades, exam results, and PII data. Data Tampering: Can modify, delete, or create user accounts. Privilege Escalation Chain: Can escalate privileges of other accounts and create backup administrator accounts. System Integrity: Can alter grades, modify scores, and delete records. Compliance Risk: Educational records may be subject to FERPA or equivalent data protection regulations. 3. Remediation Immediate Fix (auth.php) Add server-side role whitelist validation in : Long-term Recommendations 1. Implement Role-Based Access Control (RBAC), enforced on the server side. 2. Add CSRF tokens to all forms. 3. Implement email verification for new accounts. 4. Add rate limiting to the registration endpoint. 5. Log all registration attempts for auditing purposes. 6. Disable the open registration endpoint: accounts should only be created by administrators. 4. POC Code Python POC Script cURL POC (One-liner Command)

Goal Reached Thanks to every supporter — we hit 100%!

Unauth LMS Privilege Escalation: Missing Server-side Role Validation in auth.php (CVSS 9.8)

More from this source