CVE-2026-2938: Student Result Management Auth Bypass Flaw

CVE-2026-2938 Overview

A vulnerability has been identified in SourceCodester Student Result Management System 1.0 affecting the file /srms/script/admin/core/update_smtp.php. The vulnerability stems from improper access controls that allow unauthenticated attackers to manipulate SMTP configuration settings remotely. This flaw could enable attackers to hijack email functionality, potentially leading to account takeover scenarios through password reset manipulation.

Critical Impact

Unauthenticated attackers can remotely modify SMTP settings, potentially enabling account takeover through email hijacking of password reset functionality.

Affected Products

• Munyweki Student Result Management System version 1.0
• SourceCodester Student Result Management System deployments using the vulnerable update_smtp.php endpoint

Discovery Timeline

• 2026-02-22 - CVE-2026-2938 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-2938

Vulnerability Analysis

This vulnerability affects the SMTP configuration update functionality within the Student Result Management System. The core issue lies in the absence of proper authentication and authorization checks on the /srms/script/admin/core/update_smtp.php endpoint. This administrative function, which should be restricted to authenticated administrators only, can be accessed by any remote attacker without credentials.

The improper access control (CWE-266: Incorrect Privilege Assignment) allows unauthorized users to modify critical email server settings. By hijacking the SMTP configuration, an attacker could redirect all outgoing emails from the application to a server under their control. This is particularly dangerous for password reset functionality, as intercepted reset tokens could enable complete account takeover.

Root Cause

The root cause is the absence of session validation and role-based access control checks in the update_smtp.php script. The file processes SMTP configuration changes without verifying whether the requesting user has administrative privileges or is even authenticated. This represents a fundamental failure in implementing the principle of least privilege for administrative functions.

Attack Vector

The attack can be initiated remotely over the network without any user interaction. An attacker can directly send HTTP requests to the vulnerable endpoint to modify SMTP settings. The exploit has been publicly disclosed, with a proof-of-concept available demonstrating the SMTP hijacking to account takeover attack chain. The attacker does not require any prior authentication or special privileges to exploit this vulnerability.

The attack flow typically involves:

1. Identifying a vulnerable Student Result Management System installation
2. Sending crafted requests to /srms/script/admin/core/update_smtp.php to modify SMTP server settings
3. Pointing the SMTP configuration to an attacker-controlled mail server
4. Triggering password reset emails for target accounts
5. Intercepting the reset tokens and taking over user accounts

Technical details and proof-of-concept code are available in the GitHub PoC Repository.

Detection Methods for CVE-2026-2938

Indicators of Compromise

• Unauthorized HTTP requests to /srms/script/admin/core/update_smtp.php from external IP addresses
• Unexpected changes to SMTP configuration in the application database
• Outgoing email traffic redirected to unfamiliar mail servers
• User reports of not receiving password reset emails or receiving suspicious emails
• Log entries showing access to administrative endpoints without corresponding login events

Detection Strategies

• Monitor web server access logs for requests to update_smtp.php that lack authenticated session cookies
• Implement intrusion detection rules to alert on unauthenticated access attempts to administrative PHP files
• Configure database activity monitoring to detect unauthorized modifications to SMTP configuration tables
• Deploy web application firewall (WAF) rules to block unauthenticated requests to the /srms/script/admin/core/ directory

Monitoring Recommendations

• Enable verbose logging for all administrative endpoint access in the Student Result Management System
• Set up alerts for SMTP configuration changes through database triggers or application-level auditing
• Monitor outbound email traffic patterns for anomalies such as changed relay servers
• Review authentication logs regularly for failed or missing authentication attempts to admin functions

How to Mitigate CVE-2026-2938

Immediate Actions Required

• Restrict access to the /srms/script/admin/core/ directory using web server configuration until a patch is available
• Implement IP-based access controls to limit administrative endpoint access to trusted networks only
• Add authentication middleware or modify update_smtp.php to require valid admin session verification
• Review current SMTP settings to ensure they have not been tampered with
• Audit user accounts for any signs of unauthorized access or password resets

Patch Information

No official vendor patch has been identified at this time. Organizations using the Student Result Management System should implement the workarounds described below and monitor SourceCodester for security updates. Additional vulnerability details are available through VulDB #347310.

Workarounds

• Add server-level authentication requirements for the administrative directory using .htaccess or equivalent web server configuration
• Implement a Web Application Firewall (WAF) rule to block unauthenticated access to /srms/script/admin/core/update_smtp.php
• Manually add session validation code to the vulnerable PHP file to check for admin authentication
• Consider taking the application offline if it processes sensitive student data until proper mitigations are in place

# Apache .htaccess example to restrict admin directory access
# Place in /srms/script/admin/core/.htaccess

<Files "update_smtp.php">
    Require valid-user
    AuthType Basic
    AuthName "Admin Access Required"
    AuthUserFile /path/to/.htpasswd
</Files>