Improper Authorization in Online Examination System Enrollment

A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management System 1.0. This affects an unknown part of the file /ajax_enroll.php of the component Enrollment Management. The manipulation of the argument student_id/schedule_id/action leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The name of the affected product appears to have a typo in it.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-14778 is an improper authorization vulnerability affecting SourceCodester Online Examination & Learning Management System 1.0, specifically in the enrollment management component at /ajax_enroll.php. By manipulating arguments such as student_id, schedule_id, or action parameters, unauthenticated or low-privileged attackers can bypass access controls and perform unauthorized enrollment operations remotely. This vulnerability poses a significant risk to educational institutions using this system, as it allows attackers to manipulate student enrollments, access sensitive enrollment data, or disrupt legitimate academic operations. With a CVSS score of 7.3 (high severity) and public disclosure already available, this represents an active threat that requires immediate patrolling and patching across affected deployments.

Casky's 283 mapped skills detect the attack patterns behind this CVE by correlating CWE-266 (Improper Privilege Management) and CWE-285 (Improper Authorization) indicators with MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe detection signals including anomalous parameter manipulation attempts in enrollment endpoints, unauthorized state transitions in enrollment workflows, and suspicious modifications to student_id or schedule_id fields without proper session validation. Claude's extended reasoning would highlight the attack chain: reconnaissance of the vulnerable endpoint, exploitation through parameter tampering, and lateral privilege escalation within the enrollment system. The platform would flag these behavioral patterns as privilege escalation attempts and improper authorization bypasses, enabling security teams to differentiate malicious enrollment manipulation from legitimate administrative actions.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14778.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-14778

Casky has 283 skills that investigate the attack patterns behind CVE-2026-14778. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn