CVE-2026-86281 Details

A cross-site request forgery (CSRF) vulnerability has been identified in SourceCodester Syllabus-Aligned Learning Management and Examination System version 1.0. This vulnerability arises from the absence of anti-CSRF measures in all form-handling PHP files, allowing remote attackers to exploit critical state-changing operations. The lack of CSRF tokens, header validation, and SameSite cookie attributes creates a significant security risk, enabling unauthorized actions such as deleting exams or subjects, manipulating enrollment statuses, and purging attendance records.

To address this vulnerability, implement an anti-CSRF token system by generating and validating tokens for each user session. Add the tokens to all forms and validate them on the server side before processing any state-changing requests. Additionally, convert GET-based state changes to POST requests, set the SameSite attribute on session cookies, and validate the Origin or Referer headers to ensure requests originate from the application.