CVE-2026-2984: Student Result Management System DOS Flaw

CVE-2026-2984 Overview

A denial of service vulnerability has been identified in SourceCodester Student Result Management System version 1.0. This vulnerability affects the /admin/core/drop_user.php file, where improper handling of the ID argument allows remote attackers to cause service disruption. The vulnerability can be exploited remotely without authentication, and exploit information has been publicly disclosed.

Critical Impact

Remote attackers can exploit this vulnerability to delete user accounts without authentication, causing denial of service and disrupting the student result management system's availability.

Affected Products

• Munyweki Student Result Management System 1.0
• SourceCodester Student Result Management System 1.0
• Applications using /admin/core/drop_user.php endpoint

Discovery Timeline

• 2026-02-23 - CVE-2026-2984 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-2984

Vulnerability Analysis

This vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release), indicating that the application fails to properly manage resources when processing user deletion requests. The drop_user.php script in the admin core directory accepts an ID parameter that can be manipulated by attackers to trigger arbitrary account deletion.

The vulnerability exists because the endpoint lacks proper authentication checks and input validation. An unauthenticated remote attacker can send crafted HTTP requests to the /admin/core/drop_user.php file with manipulated ID values, allowing them to delete user accounts from the system without authorization.

Root Cause

The root cause of this vulnerability is the absence of authentication and authorization controls on the drop_user.php endpoint combined with improper resource management (CWE-404). The script processes incoming requests and performs account deletion operations without verifying whether the request originates from an authenticated administrator. This design flaw allows any remote attacker to invoke the user deletion functionality directly.

Attack Vector

The attack vector is network-based, requiring no user interaction or prior authentication. An attacker can remotely access the vulnerable endpoint by sending HTTP requests directly to /admin/core/drop_user.php with a crafted ID parameter. The low attack complexity means that exploitation requires minimal technical skill or resources.

The vulnerability manifests when the ID argument is manipulated in requests to the drop_user.php endpoint, allowing unauthorized deletion of user accounts. For detailed technical information about the exploitation method, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-2984

Indicators of Compromise

• Unusual HTTP requests to /admin/core/drop_user.php from external or unauthorized IP addresses
• Unexpected deletion of user accounts in the Student Result Management System database
• Access logs showing unauthenticated requests with ID parameters to administrative endpoints
• Sudden decrease in registered user count without corresponding administrative actions

Detection Strategies

• Monitor web server access logs for requests targeting /admin/core/drop_user.php from non-administrative sources
• Implement Web Application Firewall (WAF) rules to detect and block unauthenticated requests to admin endpoints
• Set up database auditing to track DELETE operations on user tables
• Deploy intrusion detection signatures for requests containing suspicious ID parameter patterns

Monitoring Recommendations

• Enable detailed logging on all requests to the /admin/core/ directory
• Configure alerts for multiple sequential requests to drop_user.php which may indicate enumeration attacks
• Monitor system availability metrics for unexpected service degradation
• Implement rate limiting on administrative endpoints to detect automated exploitation attempts

How to Mitigate CVE-2026-2984

Immediate Actions Required

• Restrict access to /admin/core/drop_user.php by implementing IP-based access controls or taking the endpoint offline
• Add authentication checks to verify administrative privileges before processing user deletion requests
• Implement input validation and sanitization for the ID parameter
• Review web server access logs for evidence of prior exploitation attempts

Patch Information

No official vendor patch has been identified at this time. Administrators should consult SourceCodester for updates regarding security fixes for Student Result Management System 1.0. Additional vulnerability details are available at VulDB #347367.

Workarounds

• Implement server-side access controls to restrict /admin/core/drop_user.php to authenticated administrators only
• Add session validation middleware that verifies admin authentication before processing requests
• Use .htaccess or web server configuration to deny direct access to the admin core directory from external networks
• Consider deploying a reverse proxy with authentication requirements for all administrative endpoints

# Example .htaccess restriction for admin directory
# Place in /admin/core/ directory
<Files "drop_user.php">
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
    Allow from 10.0.0.0/8
    # Add trusted admin IP ranges here
</Files>