CVE-2026-2983
📋 TL;DR
This vulnerability in SourceCodester Student Result Management System 1.0 allows unauthenticated attackers to upload arbitrary files via the bulk import feature, potentially leading to account takeover and system compromise. The vulnerability affects all installations of this specific software version. Remote exploitation is possible without authentication.
💻 Affected Systems
- SourceCodester Student Result Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, data theft, and unauthorized administrative access to the entire student result management system.
Likely Case
Unauthenticated attackers upload malicious files to create admin accounts, hijack SMTP settings, and gain control over the application.
If Mitigated
With proper file upload validation and authentication controls, the vulnerability would be prevented entirely.
🎯 Exploit Status
Public exploit available on GitHub demonstrates SMTP hijacking and account takeover via arbitrary file upload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch available. Consider removing the software or implementing workarounds.
🔧 Temporary Workarounds
Disable Bulk Import Feature
linuxRemove or restrict access to /admin/core/import_users.php file
mv /path/to/admin/core/import_users.php /path/to/admin/core/import_users.php.disabled
chmod 000 /path/to/admin/core/import_users.php
Implement Web Application Firewall Rules
allBlock requests to import_users.php and restrict file uploads
🧯 If You Can't Patch
- Remove the system from internet-facing networks immediately
- Implement strict network segmentation and access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check if /admin/core/import_users.php exists and is accessible without authentication. Test with a simple file upload attempt.Check Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify import_users.php is inaccessible or removed. Test authentication requirements for all admin functions.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /admin/core/import_users.php without authentication
- File upload attempts with unusual extensions
- Unauthorized admin account creation
Network Indicators:
- Unusual traffic to import_users.php endpoint
- File uploads to admin directory without authentication
SIEM Query:
source="web_logs" AND (uri="/admin/core/import_users.php" OR method="POST" AND uri CONTAINS "import_users") AND NOT user_agent="legitimate_bot"