Hard-Coded Credentials in SourceCodester Syllabus-Aligned Learning Management & Examination System

A critical vulnerability exists in version 1.0 of the SourceCodester Syllabus-Aligned Learning Management & Examination System. The issue resides within the 'db.php' file, which contains hard-coded credentials that can be exploited by remote, unauthenticated attackers to gain unauthorized access to the system. Since the credentials are embedded directly within the source code of the database configuration file, any instance of this software exposed to the internet is inherently vulnerable. Attackers with knowledge of the default codebase can gain administrative or database-level access without needing to perform traditional brute-force or credential-harvesting activities. Proof-of-concept exploit code has been published publicly, increasing the risk of active exploitation by opportunistic actors. Organizations currently running this specific version of the Learning Management System (LMS) should immediately restrict network access or audit the configuration to rotate compromised credentials.

Impact

Successful exploitation allows remote, unauthenticated attackers to gain unauthorized access to the application, potentially leading to full database compromise, sensitive data exfiltration, and administrative control over the learning environment. This vulnerability affects all deployments of version 1.0 of the Syllabus-Aligned Learning Management & Examination System.

Recommendation

Prioritize auditing all instances of the SourceCodester Syllabus-Aligned Learning Management & Examination System. Immediately rotate any credentials found within 'db.php' and ensure that the application is not exposed to the public internet. If the system cannot be immediately updated or secured, restrict network access to the application using a web application firewall or VPN.