A high-severity authorization bypass vulnerability in the SourceCodester Syllabus-Aligned Learning Management & Examination System permits unauthorized users to delete exams, modify student enrollments, and access private content.

The application suffers from multiple Insecure Direct Object Reference (IDOR) flaws due to the lack of server-side ownership verification when processing requests. Depending on the specific endpoint, the vulnerability allows unauthenticated users or lower-privileged accounts to manipulate parameters to delete exams, alter enrollment statuses, or view unauthorized educational materials.

The exploitation of these vulnerabilities poses a significant risk to the integrity and availability of academic records. An attacker could maliciously delete examination data, disrupt enrollment workflows, or gain unauthorized access to sensitive syllabus content, leading to severe operational disruption and potential compromise of student privacy. Given the CVSS score of 7.3, the risk of data manipulation and unauthorized access is substantial for educational institutions relying on this platform.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the application by placing it behind a secure VPN or an authenticated proxy, and consider disabling the system until the vendor provides a security update.

Proactive Monitoring: Review web server access logs for anomalous patterns, such as sequential ID scanning in GET requests to files like delete_exam.php, approve_enrollment.php, or view.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to inspect and block requests containing suspicious parameter manipulation or unauthorized access attempts to the identified vulnerable endpoints.

Public Exploit Available: Yes — a published proof-of-concept exists in the security research write-up linked by the CVE record.

The presence of multiple IDOR vulnerabilities in the core functionality of this system presents a critical security risk. Because the application fails to perform basic authorization checks, it is highly susceptible to both horizontal and vertical privilege escalation. Administrators must prioritize the implementation of compensating controls and maintain a heightened state of vigilance until the vendor releases a patched version that enforces strict authorization logic across all endpoints.