CVE-2025-13468: Alumni Management System Auth Bypass Flaw

CVE-2025-13468 Overview

CVE-2025-13468 is a missing authorization vulnerability [CWE-862] in SourceCodester Alumni Management System 1.0. The flaw resides in the delete_forum, delete_career, delete_comment, delete_gallery, and delete_event functions of admin/admin_class.php. An attacker with low privileges can manipulate the ID argument to delete arbitrary records belonging to other users. The attack is exploitable remotely over the network and requires no user interaction. Public disclosure of the exploitation technique has occurred through VulDB submission #694826.

Critical Impact
Authenticated low-privilege attackers can remotely delete forum posts, career listings, comments, gallery items, and events without proper authorization checks.

Affected Products

Oretnom23 Alumni Management System 1.0
SourceCodester Alumni Management System (distributed build)
Deployments using admin/admin_class.php Delete Handler component

Discovery Timeline

2025-11-20 - CVE-2025-13468 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13468

Vulnerability Analysis

The vulnerability stems from the absence of authorization checks within the delete handlers in admin/admin_class.php. The five affected functions, delete_forum, delete_career, delete_comment, delete_gallery, and delete_event, accept an ID parameter and immediately operate on the corresponding database record. The application fails to verify whether the requesting session owns the target resource or holds an administrative role. This maps to CWE-862: Missing Authorization. Any authenticated user can invoke administrative delete operations and destroy data belonging to other users.

Root Cause

The root cause is the lack of access control enforcement at the function entry point. The handlers trust the session as authenticated without verifying role or ownership of the targeted resource. Server-side authorization logic, which should compare the session identity against the record's owner or required role, is not present before the SQL DELETE statement executes.

Attack Vector

An attacker authenticates to the application using any valid low-privilege account. The attacker then issues an HTTP POST request to admin/admin_class.php invoking one of the five delete actions with a chosen ID value. The handler executes the deletion without validating the requester's authorization. Detailed reproduction notes are available in the HackMD Source Code Documentation and the VulDB CTI #333041 entry. Public exploit details are referenced in VulDB Submission #694826.

Detection Methods for CVE-2025-13468

Indicators of Compromise

Unexpected DELETE SQL statements in MySQL query logs targeting forum, career, comment, gallery, or event tables.
HTTP POST requests to admin/admin_class.php with action values such as delete_forum, delete_career, delete_comment, delete_gallery, or delete_event originating from non-administrative sessions.
Missing records reported by users without corresponding administrative audit entries.

Detection Strategies

Enable verbose web server logging and inspect POST bodies sent to admin/admin_class.php for delete-action parameters.
Correlate session identifiers issuing delete actions against the user role table to surface privilege mismatches.
Deploy a web application firewall rule that flags requests invoking delete actions from sessions not bound to an administrator role.

Monitoring Recommendations

Forward web access logs and database audit logs to a centralized analytics platform for cross-source correlation.
Alert on bursts of delete operations within short time windows targeting forum, career, comment, gallery, or event records.
Track HTTP referers and user-agent strings associated with administrative endpoints to identify scripted abuse.

How to Mitigate CVE-2025-13468

Immediate Actions Required

Restrict network access to the Alumni Management System administrative interface using IP allowlists or VPN gating.
Disable or remove the admin/admin_class.php delete actions until an authorization patch is applied.
Audit existing user accounts and revoke unnecessary low-privilege accounts that could be used for exploitation.

Patch Information

No vendor patch is listed in the NVD entry for CVE-2025-13468 at the time of publication. Operators should contact the maintainer through the SourceCodester Resource Portal and monitor the VulDB #333041 entry for updates. Until an official fix is available, apply the workarounds below.

Workarounds

Add a server-side role check at the start of each delete function in admin/admin_class.php that verifies the session user holds the administrator role before executing the SQL DELETE.
Introduce ownership validation that compares the record owner against the session identity for user-scoped resources such as comments and forum posts.
Place the administrative directory behind HTTP authentication or a reverse proxy that enforces role-based access control.

bash

# Example Apache configuration restricting admin path to internal network
<Directory "/var/www/alumni/admin">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Directory>