{"uuid": "fa5e0904-8808-482f-ad20-6231614df885", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5326", "type": "seen", "source": "https://gist.github.com/alon710/7412d8adaff2427de50f99e5817de762", "content": "# CVE-2026-5326: CVE-2026-5326: Insecure Direct Object Reference (IDOR) in SourceCodester Leave Application System\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-04-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-5326\n\n## Summary\nAn Insecure Direct Object Reference (IDOR) vulnerability exists in SourceCodester Leave Application System 1.0 within the User Information Handler component. The application processes client-supplied database identifiers via URL parameters without executing proper authorization checks or session validation. This allows remote, unauthenticated attackers to view sensitive administrative and employee records by altering the 'id' parameter.\n\n## TL;DR\nUnauthenticated remote attackers can bypass administrative access boundaries to read sensitive employee records and administrative data by manipulating the numeric ID parameter inside '/index.php?page=manage_user'.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639 / CWE-285\n- **Attack Vector**: Network (Remote)\n- **Required Privileges**: None (Unauthenticated)\n- **CVSS v4.0 Base Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00404\n- **CISA KEV Status**: Not Listed\n- **Exploit Status**: Proof-of-Concept Publicly Available\n\n## Affected Systems\n\n- SourceCodester Leave Application System 1.0\n- **Leave Application System**: 1.0 (Fixed in: `None`)\n\n## Mitigation\n\n- Implement role-based access control (RBAC) to ensure only administrators can access user administration pages.\n- Enforce session-to-parameter matching inside 'index.php?page=manage_user' to restrict non-administrative users to their own profile.\n- Utilize non-sequential random identifiers such as UUIDs to prevent sequential numeric index enumeration.\n\n**Remediation Steps:**\n1. Locate the PHP template responsible for processing user details within the SourceCodester deployment.\n2. Insert session control instructions (using 'session_start()') if they are not already globally implemented.\n3. Compare the user-supplied 'id' parameter with the validated session 'user_id' parameter.\n4. Verify if the active session holds administrator privileges when non-matching records are requested.\n5. Return an HTTP 403 response if the authorization validation checks fail.\n\n## References\n\n- [Insecure Direct Object Reference (IDOR) in Leave Application System PHP SQLite3](https://medium.com/@hemantrajbhati5555/insecure-direct-object-reference-idor-in-leave-application-system-php-sqlite3-66af35b8b6ea)\n- [VulDB Advisory Entry](https://vuldb.com/vuln/354657)\n- [VulDB CTI Indicators Feed](https://vuldb.com/vuln/354657/cti)\n- [VulDB Submission Record](https://vuldb.com/submit/780773)\n- [Product Source Portal](https://www.sourcecodester.com/)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-5326)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-5326) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-28T11:02:01.055442Z"}