A flaw in the createUser.php script of SourceCodester Gas Agency Management System 1.0 allows an attacker to manipulate inputs and bypass the system’s access controls. This improper access control (CWE‑284) combined with incorrect permission assignment (CWE‑266) means that users who should not be able to create or modify accounts could potentially instantiate privileged accounts or alter existing ones, compromising both confidentiality and integrity of the system. The vulnerability can be exploited remotely via crafted HTTP requests, potentially giving an attacker system‑wide control over user accounts.

The vulnerability affects the SourceCodester Gas Agency Management System version 1.0, specifically the file at /gasmark/php_action/createUser.php. No other product or version information is listed.

The CVSS score of 5.3 classifies the issue as medium severity, but the EPSS score of less than 1% indicates a low probability of exploitation at this time. The vulnerability is not present in the CISA KEV catalog. Attackers can exploit this remotely by targeting the public createUser.php endpoint, providing crafted parameters that the application fails to properly authenticate or authorize. The exploitation path therefore requires an open HTTP interface and the ability to modify input payloads to bypass access checks.