Attack Chain

1. Initial Access / Reconnaissance: An unauthenticated remote attacker identifies a SourceCodester Onlne Examination & Learning Management System 1.0 instance, potentially by scanning for known web application paths.
2. Vulnerability Identification: The attacker targets the /ajax_enroll.php endpoint, recognizing its role in enrollment management.
3. Parameter Manipulation: The attacker crafts HTTP POST or GET requests to /ajax_enroll.php, specifically manipulating the student_id, schedule_id, or action parameters with unexpected or malicious values.
4. Authorization Bypass: The vulnerable system processes these manipulated parameters without adequate authorization checks, failing to properly validate the attacker's permissions or the legitimacy of the request.
5. Unauthorized Action: Due to the improper authorization, the system executes the requested action as if the attacker possessed legitimate privileges (e.g., enrolling a student, modifying a schedule, or other administrative functions).
6. Impact on System Integrity/Confidentiality: The attacker successfully gains unauthorized access to sensitive functionalities or data, leading to data modification, unauthorized data exposure, or full system compromise.

Impact

The successful exploitation of CVE-2026-14778 could lead to significant unauthorized access and data integrity issues. Attackers could enroll or unenroll students, modify examination schedules, or alter learning materials without legitimate credentials. This could disrupt educational operations, compromise the integrity of academic records, or expose sensitive student and course data. While no specific victim count or targeted sectors are currently identified, any organization using SourceCodester Onlne Examination & Learning Management System 1.0 is at risk.

Recommendation

1. Apply any available patches or vendor advisories immediately for SourceCodester Onlne Examination & Learning Management System 1.0 to address CVE-2026-14778.
2. Enable comprehensive webserver access logging to monitor for suspicious requests to /ajax_enroll.php that manipulate parameters related to student_id, schedule_id, or action.
3. Implement Web Application Firewall (WAF) rules to detect and block anomalous requests targeting the student_id, schedule_id, or action parameters within requests to /ajax_enroll.php.

Attack Chain

1. Reconnaissance: An attacker identifies a publicly accessible instance of SourceCodester Onlne Examination & Learning Management System 1.0.
2. Vulnerability Identification: The attacker confirms the application version and identifies the vulnerable register.php endpoint.
3. Crafted Request: The attacker crafts an HTTP POST request to /register.php that includes a manipulated role argument within the registration data.
4. Exploitation: The crafted request is sent to the vulnerable endpoint, attempting to assign an elevated role (e.g., 'admin', 'instructor') to a newly created user account.
5. Privilege Assignment: Due to improper privilege management inherent in CVE-2026-14719, the system processes the request and creates the new user with the attacker-specified elevated role.
6. Unauthorized Access: The attacker logs into the system using the credentials of the newly created account, now possessing administrative or other highly privileged access.
7. Impact: The attacker gains full control over system functionalities, potentially accessing sensitive student records, modifying examination content, or disrupting learning operations.

Impact

The exploitation of CVE-2026-14719 can lead to severe consequences. Attackers can achieve unauthorized privilege escalation, granting them full administrative control over the SourceCodester Onlne Examination & Learning Management System. This can result in data breaches involving sensitive student or faculty information, unauthorized modification of grades or course materials, system downtime, and reputational damage for educational institutions. The public availability of an exploit significantly increases the likelihood of widespread attacks, putting all unpatched instances at immediate risk of compromise. The CVSS 3.1 Base Score of 7.3 (High) underscores the critical nature of this vulnerability.

Recommendation

• Patch CVE-2026-14719: Immediately apply any available patches or vendor-provided mitigations for SourceCodester Onlne Examination & Learning Management System 1.0 to address CVE-2026-14719.
• Implement WAF Rules: Deploy a Web Application Firewall (WAF) to block HTTP POST requests to /register.php that contain suspicious role parameter manipulations, as indicated in the Sigma rule.
• Monitor Web Logs: Enable and review web server logs for /register.php access patterns, specifically looking for HTTP POST requests with a role argument, as described in the provided Sigma rule.
• Audit New User Registrations: Regularly audit new user registrations for the SourceCodester Onlne Examination & Learning Management System, paying close attention to any accounts created with elevated or unusual privilege levels.