Authorization Bypass in SourceCodester Class and Exam Timetabling System

SourceCodester Class and Exam Timetabling System version 1.0 contains a critical missing authorization vulnerability identified as CVE-2026-85512. The flaw resides within the /admin/session.php file, where the ID argument is insufficiently validated. This vulnerability allows remote, unauthenticated attackers to bypass access controls and perform actions intended for administrative users. With exploit code currently available in the public domain, this vulnerability poses a significant risk to any organization deploying this specific version of the system. Defenders should prioritize identifying instances of this software within their environments and restricting access to administrative endpoints while awaiting a vendor patch or remediation.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass authorization, potentially leading to unauthorized data access, system configuration changes, or full administrative compromise of the affected Class and Exam Timetabling System instance.

Recommendation

• Audit network assets to identify instances of SourceCodester Class and Exam Timetabling System version 1.0.
• Restrict access to the /admin/ directory and session.php files to trusted administrative IP addresses via firewall rules.
• Monitor web server access logs for anomalous GET or POST requests targeting /admin/session.php containing manipulated ID parameters.