A critical authentication bypass in SourceCodester Simple Traffic Offense System v1.0 allows unauthenticated remote attackers to create administrator accounts and gain full system control.

The application fails to perform server-side authentication or authorization checks on the saveuser.php endpoint. By manipulating the position parameter in a crafted HTTP request, an unauthenticated attacker can force the application to create a new user account with administrative privileges.

Successful exploitation results in full administrative compromise of the application, leading to unauthorized access to sensitive traffic offense data. Given the CVSS score of 7.3, this represents a significant risk of data exfiltration, system manipulation, and potential loss of data integrity. Unauthorized administrative access can further be leveraged to pivot into the underlying host environment or disrupt critical reporting functions.

Immediate Action: As no vendor patch is currently available, administrators should immediately restrict access to the saveuser.php file via web server configuration or disable the user creation module until a fix is released.

Proactive Monitoring: Review web server access logs for anomalous POST requests to saveuser.php, specifically looking for attempts that lack valid session identifiers or originate from unauthorized network segments.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the saveuser.php script and monitor for any suspicious modifications to the user database.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the referenced GitHub advisory.

This vulnerability presents a severe risk due to the ease of privilege escalation and the lack of server-side validation. Organizations currently running this software must treat the absence of a vendor patch as an urgent requirement to implement restrictive network access controls or disable the vulnerable component entirely. Prioritize the auditing of all existing user accounts to identify any unauthorized administrative entries created via this mechanism.