SourceCodester Onlne Examination & Learning Management System contains a flaw in ajax_enroll.php that allows manipulation of student_id, schedule_id, and action parameters without proper authorization checks. Because the enforcement logic is bypassed, an attacker can enroll any student into any course or perform other enrollment actions that should require permissions, compromising integrity and permitting unauthorized enrollment.

SourceCodester Onlne Examination & Learning Management System version 1.0, specifically the ajax_enroll.php file in the Enrollment Management component. No other vendors or product versions are noted as affected.

The CVSS base score of 6.9 indicates a moderate severity. The EPSS score reported as <1% indicates a non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can remotely exploit the flaw by sending crafted HTTP requests to /ajax_enroll.php, manipulating the student_id, schedule_id, and action query parameters. No explicit preconditions such as authentication are described, suggesting that successful exploitation may not require privileged credentials, but this inference is not guaranteed.