A critical access control flaw in SourceCodester Student Result Management System 1.0 allows unauthenticated attackers to manipulate administrative functions, posing a severe risk of system compromise.

The application fails to perform session validation or capability checks within the /admin/core/import_users.php endpoint. This allows an unauthenticated attacker to inject accounts or manipulate system configurations by sending crafted POST requests directly to the vulnerable script.

Successful exploitation allows an unauthenticated attacker to gain administrative control over the application. This could lead to full system takeover, unauthorized access to sensitive student records, or the hijacking of mail infrastructure for further phishing and credential theft. The CVSS score of 7.3 reflects the high risk of unauthorized access and potential data exfiltration.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using network-level controls or web server authentication. Disable the bulk import feature until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous POST requests targeting the /admin/core/ directory. Monitor user account creation logs for suspicious or unauthorized entries.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthenticated access to administrative scripts and filter POST requests targeting known vulnerable endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the security research write-up referenced in the CVE data.

Given the availability of public proof-of-concept code and the lack of an official patch, this vulnerability presents a significant risk to organizations using the Student Result Management System 1.0. Organizations must prioritize restricting network access to the administrative interface and implementing robust monitoring to detect any attempts to exploit these missing authorization checks until the vendor provides a secure update.