A critical authorization bypass vulnerability in SourceCodester Client Database Management System allows unauthenticated attackers to delete system users, posing a severe risk to data integrity.

The application fails to implement mandatory authentication or authorization checks on the /superadmin_delete_manager.php endpoint. An unauthenticated attacker can supply a specific manager_id parameter via a POST request to successfully remove administrative records from the database.

The ability for an unauthenticated user to delete sales managers directly impacts business operations and data integrity. This vulnerability could lead to significant administrative disruption, unauthorized loss of system access for legitimate staff, and potential sabotage of client database records. With a CVSS score of 7.3, this flaw is categorized as High severity due to the ease of exploitation and the direct impact on system availability and integrity.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /superadmin_delete_manager.php file at the web server level or disable the component entirely if it is not business-critical.

Proactive Monitoring: Review web access logs for any POST requests directed to /superadmin_delete_manager.php originating from unauthorized or external IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or challenge all requests to the vulnerable endpoint, ensuring that only trusted administrative sessions can reach the script.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in a GitHub Gist by the security researcher.

Given the availability of a functional proof-of-concept and the lack of an official patch, this vulnerability presents an immediate operational risk. Organizations utilizing this software must prioritize network-level restrictions to prevent unauthorized access to the vulnerable endpoint. Until a vendor-supplied update is released and verified, treat the affected system as compromised and implement strict access controls to prevent further exploitation.