Listen to this Post
The vulnerability resides in the /Admin/delete-fee.php file of SourceCodester Online Student Clearance System 1.0. This script is part of the Fee Table Handler component designed to delete fee records from the database. It improperly handles the ‘ID’ parameter passed in user requests. The application fails to verify if the user is authorized to perform deletion actions. Attackers can remotely manipulate the ‘ID’ argument without authentication. This allows arbitrary deletion of fee entries by crafting malicious HTTP requests. The flaw is an Insecure Direct Object Reference (IDOR) due to missing access controls. Exploitation involves sending a GET or POST request with a modified ID value. For example, accessing http://target.com/Admin/delete-fee.php?ID=123 can delete record 123. No session validation or role-based checks are performed before database operations. The attack has low complexity and requires no user interaction. Public disclosure of the exploit increases the risk of widespread attacks. The CVSS 4.0 score rates it medium with vector AV:N/AC:L/AT:N/PR:N/UI:N. Impacts include loss of data integrity and availability as fees are deleted unlawfully. The vulnerability stems from trusting user input directly in SQL queries. Database queries likely concatenate the ID without proper sanitization. This can lead to further issues like SQL injection if input is not filtered. System administrators may face service disruption and financial record tampering. Immediate measures include restricting access to the vulnerable file or applying patches.
Platform: SourceCodester Online Student Clearance System
Version: 1.0
Vulnerability: Improper Authorization
Severity: Medium
date: 12/07/2025
Prediction: Expected 2025-12-31
What Undercode Say:
Analytics:
bash commands:
curl -X GET “http://target.com/Admin/delete-fee.php?ID=1”
curl -X POST “http://target.com/Admin/delete-fee.php” -d “ID=2”
codes:
// Vulnerable code snippet from delete-fee.php
$id = $_GET[‘ID’];
$sql = “DELETE FROM fees WHERE id = $id”;
// No authorization check
?>
How Exploit:
Remote attackers send crafted requests to delete arbitrary fee records by ID manipulation without authentication.
Protection from this CVE:
Implement proper authorization checks, validate user sessions, use role-based access control, and sanitize input.
Impact:
Unauthorized data deletion, loss of integrity, service disruption, financial record tampering.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
