CVE-2026-14775: SourceCodester LMS Auth Bypass Vulnerability

CVE-2026-14775 Overview

CVE-2026-14775 is an unrestricted file upload vulnerability in SourceCodester Online Examination & Learning Management System 1.0. The flaw resides in the /process_lesson.php script, where manipulation of the user_id argument enables an authenticated remote attacker to upload arbitrary files to the server. The weakness is classified under CWE-284: Improper Access Control. Public exploit details are available through a GitHub proof-of-concept, increasing the likelihood of opportunistic abuse against exposed instances.

Critical Impact
Remote authenticated attackers can upload arbitrary files through /process_lesson.php, enabling potential webshell deployment and follow-on remote code execution against the LMS host.

Affected Products

SourceCodester Online Examination & Learning Management System 1.0
The vendor product name in the CVE record contains a typo ("Onlne Examination") as noted in the original advisory
No official vendor patch or CPE has been published at the time of NVD ingestion

Discovery Timeline

2026-07-05 - CVE-2026-14775 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-14775

Vulnerability Analysis

The vulnerability affects the /process_lesson.php endpoint in SourceCodester Online Examination & Learning Management System 1.0. The endpoint accepts a user_id parameter that is processed without adequate access control or file-type validation. As a result, an authenticated user with low privileges can submit crafted requests that upload attacker-controlled files to the web server.

Because the application does not restrict file extensions, MIME types, or storage paths, attackers can place executable PHP content into a web-accessible directory. Retrieving that file via HTTP allows the PHP interpreter to execute attacker-supplied code, effectively converting the upload primitive into remote code execution on the underlying host.

The attack is remotely reachable, requires low privileges, and does not require user interaction. A public proof-of-concept is hosted on GitHub, which lowers the technical barrier for adversaries seeking to weaponize the issue.

Root Cause

The root cause is improper access control [CWE-284] combined with missing server-side validation of uploaded content. /process_lesson.php trusts the user_id parameter and the associated file payload without enforcing role checks, extension allowlists, or content inspection before writing the file to disk.

Attack Vector

An attacker authenticates to the LMS with any valid low-privilege account, then issues an HTTP POST request to /process_lesson.php containing a manipulated user_id value and a malicious file attachment. The server persists the file in a location reachable by the web server, allowing the attacker to invoke it and gain code execution in the context of the web process.

No verified exploit code is reproduced here. Technical write-up and reproduction steps are documented in the GitHub PoC repository and the VulDB CVE-2026-14775 entry.

Detection Methods for CVE-2026-14775

Indicators of Compromise

HTTP POST requests to /process_lesson.php containing multipart file uploads with executable extensions such as .php, .phtml, or .phar
New files with server-side script extensions appearing in LMS upload directories after user activity
Outbound connections from the LMS web server process (php-fpm, apache2, nginx) to unfamiliar destinations following upload events
Unexpected shell processes (sh, bash, cmd.exe) spawned as children of the web server process

Detection Strategies

Inspect web server access logs for POST requests to /process_lesson.php with anomalous user_id values or oversized multipart payloads
Deploy web application firewall rules that block uploads with dangerous extensions and enforce Content-Type validation on the endpoint
Correlate file creation events in the LMS upload directory with subsequent HTTP GET requests to the same filenames to identify webshell staging and invocation

Monitoring Recommendations

Enable file integrity monitoring on LMS document roots and alert on creation of files with executable extensions
Log and review all authenticated actions performed by low-privilege LMS accounts, focusing on lesson-processing workflows
Forward web server and application logs to a centralized analytics platform for retrospective hunting against the indicators above

How to Mitigate CVE-2026-14775

Immediate Actions Required

Restrict network access to the LMS to trusted networks or authenticated VPN users until a fix is available
Disable or protect /process_lesson.php with additional access controls that verify the requesting user's role before accepting uploads
Audit the LMS upload directory for unauthorized files created since deployment and remove any suspicious artifacts
Rotate credentials for all LMS accounts and review privilege assignments to reduce the pool of accounts capable of exploiting the endpoint

Patch Information

At the time of publication, no official vendor patch has been released by SourceCodester for CVE-2026-14775. Administrators should monitor the SourceCodester project page and the VulDB advisory for updates. If a fixed release is not available, consider replacing the vulnerable software or applying compensating controls described below.

Workarounds

Configure the web server to deny execution of scripts inside the LMS upload directory using php_flag engine off in Apache or an equivalent location block in Nginx
Implement a server-side allowlist that restricts uploads to non-executable content types such as PDF and common image formats, and rename stored files to strip original extensions
Place the LMS behind a web application firewall with rules that block multipart uploads containing PHP tags or executable signatures

bash

# Example Nginx configuration to prevent script execution in the upload directory
location ^~ /uploads/ {
    default_type text/plain;
    location ~ \.(php|phtml|phar|phps)$ {
        deny all;
        return 403;
    }
}