CVE-2026-75151: Online Examination System CSRF Vulnerability

CVE-2026-75151 Overview

CVE-2026-75151 is a cross-site request forgery (CSRF) vulnerability in SourceCodester Online Examination & Learning Management System 1.0. The flaw resides in an unspecified functionality of the web application and allows remote attackers to trick authenticated users into submitting unwanted state-changing requests. Exploitation requires user interaction, such as visiting an attacker-controlled page while logged in. The weakness is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
A remote attacker can force an authenticated user's browser to submit forged requests to the application, resulting in unauthorized state changes without the victim's consent.

Affected Products

SourceCodester Online Examination & Learning Management System 1.0
Deployments derived from the SourceCodester 1.0 codebase
Forks and rebrands of the same PHP source distribution

Discovery Timeline

2026-08-18 - CVE-2026-75151 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75151

Vulnerability Analysis

The application exposes state-changing endpoints without validating that requests originate from the legitimate user interface. An attacker crafts a malicious HTML page containing a form or image tag that targets a vulnerable endpoint. When an authenticated administrator or user loads the attacker's page, the browser attaches session cookies and issues the request. The server accepts the request as authentic because no anti-CSRF token, SameSite cookie protection, or Origin/Referer verification is enforced. The flaw is remotely exploitable over the network and requires only that the victim interact with attacker-supplied content.

Root Cause

The application lacks synchronizer tokens on sensitive HTTP requests. Session cookies are transmitted on cross-origin requests by default, and no server-side validation confirms the request's origin. This matches the classic CWE-352 pattern documented in the VulDB advisory.

Attack Vector

An attacker hosts a page containing an auto-submitting form or embedded resource that targets a privileged endpoint of the vulnerable installation. The attacker then lures an authenticated user to the page through phishing, forum posts, or malvertising. The victim's browser silently issues the forged request using the active session, and the server processes it as a legitimate action. Detailed technical context is available at VulDB Vulnerability #391392.

No verified proof-of-concept code is published for this CVE. Refer to the VulDB submission record for reporter-supplied details.

Detection Methods for CVE-2026-75151

Indicators of Compromise

HTTP requests to state-changing endpoints with Referer or Origin headers pointing to unrelated external domains.
Unexpected administrative actions (user creation, grade modification, content changes) performed shortly after users visited external links.
Absence of CSRF token parameters in POST requests captured in web server logs.

Detection Strategies

Inspect web server access logs for POST requests missing anti-CSRF token parameters or arriving with mismatched Origin headers.
Deploy a web application firewall (WAF) rule that flags cross-origin form submissions to the Online Examination & Learning Management System.
Correlate session activity with browser referrer data to identify actions initiated from untrusted origins.

Monitoring Recommendations

Alert on bursts of privileged administrative actions originating from a single session within a short window.
Monitor for user reports of unauthorized changes to accounts, exam data, or course materials.
Track outbound phishing indicators that reference the application's endpoints in URL parameters.

How to Mitigate CVE-2026-75151

Immediate Actions Required

Restrict access to the application to trusted networks or a VPN until a vendor patch is available.
Enforce SameSite=Strict or SameSite=Lax attributes on session cookies to block cross-site cookie transmission.
Require users to log out of administrative sessions when not actively working in the application.

Patch Information

No vendor patch is referenced in the NVD entry or the VulDB advisory at the time of publication. Monitor the SourceCodester Resource Hub for updated releases addressing CVE-2026-75151.

Workarounds

Add synchronizer tokens to every state-changing form and validate them server-side before processing requests.
Validate the Origin and Referer headers on POST, PUT, and DELETE endpoints and reject mismatches.
Deploy a WAF policy that blocks cross-origin requests to sensitive URLs of the Online Examination & Learning Management System.
Educate administrators to avoid clicking untrusted links while authenticated to the application.

bash

# Example nginx configuration enforcing SameSite cookies and Referer validation
add_header Set-Cookie "PHPSESSID=$cookie_PHPSESSID; Path=/; HttpOnly; Secure; SameSite=Strict";

location ~ \.php$ {
    if ($request_method = POST) {
        set $csrf_ok 0;
        if ($http_origin ~* "^https?://your-trusted-domain\.example$") { set $csrf_ok 1; }
        if ($csrf_ok = 0) { return 403; }
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}