CVE-2026-2984 Details

A denial-of-service vulnerability has been identified in SourceCodester Student Result Management System version 1.0. The issue resides in the file /admin/core/drop_user.php, where the script lacks authentication and authorization checks. This vulnerability allows an unauthenticated remote attacker to delete the Super Administrator account by sending a crafted GET request with the id parameter. The exploitation of this vulnerability leads to a permanent loss of access to the administrative panel, causing a critical disruption in system management.

To address this vulnerability, it is recommended to implement session-based access control in the affected script. This can be done by adding a session validation check to ensure that the user is logged in and has the appropriate administrative privileges before allowing account deletion.