DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-5326: CVE-2026-5326: Insecure Direct Object Reference (IDOR) in SourceCodester Leave Application System

#security #cve #cybersecurity

CVE-2026-5326: Insecure Direct Object Reference (IDOR) in SourceCodester Leave Application System

Vulnerability ID: CVE-2026-5326
CVSS Score: 5.3
Published: 2026-04-02

An Insecure Direct Object Reference (IDOR) vulnerability exists in SourceCodester Leave Application System 1.0 within the User Information Handler component. The application processes client-supplied database identifiers via URL parameters without executing proper authorization checks or session validation. This allows remote, unauthenticated attackers to view sensitive administrative and employee records by altering the 'id' parameter.

TL;DR

Unauthenticated remote attackers can bypass administrative access boundaries to read sensitive employee records and administrative data by manipulating the numeric ID parameter inside '/index.php?page=manage_user'.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-639 / CWE-285
  • Attack Vector: Network (Remote)
  • Required Privileges: None (Unauthenticated)
  • CVSS v4.0 Base Score: 6.9 (Medium)
  • EPSS Score: 0.00404
  • CISA KEV Status: Not Listed
  • Exploit Status: Proof-of-Concept Publicly Available

Affected Systems

  • SourceCodester Leave Application System 1.0
  • Leave Application System: 1.0 (Fixed in: None)

Exploit Details

  • Medium Writeup: Original writeup detailing the discovery and manual confirmation of the IDOR vulnerability.

Mitigation Strategies

  • Implement role-based access control (RBAC) to ensure only administrators can access user administration pages.
  • Enforce session-to-parameter matching inside 'index.php?page=manage_user' to restrict non-administrative users to their own profile.
  • Utilize non-sequential random identifiers such as UUIDs to prevent sequential numeric index enumeration.

Remediation Steps:

  1. Locate the PHP template responsible for processing user details within the SourceCodester deployment.
  2. Insert session control instructions (using 'session_start()') if they are not already globally implemented.
  3. Compare the user-supplied 'id' parameter with the validated session 'user_id' parameter.
  4. Verify if the active session holds administrator privileges when non-matching records are requested.
  5. Return an HTTP 403 response if the authorization validation checks fail.

References

Read the full report for CVE-2026-5326 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)