A flaw in the register.php endpoint of SourceCodester Onlne Examination & Learning Management System allows an attacker to manipulate the role argument, leading to improper privilege management. This vulnerability is a classic example of CWE-266 and CWE-269, where an application fails to enforce correct privilege restrictions, potentially giving an attacker higher privileges than intended. Remote exploitation is possible and an exploit is already published, meaning that the threat is not theoretical but active in the wild.

The affected product is SourceCodester Onlne Examination & Learning Management System. The vulnerability resides in an unknown internal function within the register.php file of the Registration Endpoint. The typo in the product name does not affect the versioning; the system is vulnerable when running any install of version 1.0 that has not yet been patched.

With a CVSS score of 6.9, the vulnerability falls into the moderate impact range. The EPSS score is <1%, indicating a very low but non-zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; the attacker must have network access to the registration endpoint and can send crafted requests to manipulate the role argument, enabling improper privilege management. An exploit is already published, meaning attackers could readily deploy it in environments where the vulnerable system is exposed.