The flaw resides in the fetch_manager_details.php endpoint of SourceCodester Client Database Management System 1.0, where manipulating the manager_id argument bypasses the system’s authorization checks. This improper authorization allows an attacker to retrieve manager detail records that they should not have access to, potentially exposing sensitive personal or organizational data. The weakness falls under CWE-266 (Privilege Escalation: Improper Restriction of Privileges) and CWE-285 (Improper Authorization).

Both SourceCodester’s Client Database Management System version 1.0 and any installations that have not patched the fetch_manager_details.php endpoint are vulnerable. The vulnerability affects the Endpoint component, and any environment deploying this version without the fix is at risk.

With a CVSS score of 6.9 the vulnerability is considered moderate to high. The EPSS score is less than 1 percent, indicating low current exploitation probability, yet publicly disclosed exploitation scripts confirm that it can be launched remotely. The CVE is not listed in CISA’s KEV catalog, but the existence of published exploits and a remote attack vector warrants proactive remediation. Attackers would typically send crafted HTTP requests to the vulnerable endpoint from the Internet, altering the manager_id parameter to access data for arbitrary managers, potentially escalating privileges within the system.