CVE-2025-70141: Critical severity Sourcecodester Customer Support System vulnerability
SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in adminclass.php based on the action parameter. An unauthenticated remote attacker can perform sensitive operations such as creating customers and deleting users (including the admin account), as well as modifying or deleting other application records (tickets, departments, comments), resulting in unauthorized data modification.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-70141?
CVE-2025-70141 is classified as a critical vulnerability due to the risk of unauthorized access to administrative functions.
How do I fix CVE-2025-70141?
To mitigate CVE-2025-70141, implement proper authentication and authorization checks in the ajax.php file before allowing access to administrative methods.
Who is affected by CVE-2025-70141?
CVE-2025-70141 affects users of SourceCodester Customer Support System version 1.0.
Can CVE-2025-70141 be exploited remotely?
Yes, CVE-2025-70141 can be exploited by unauthenticated remote attackers to invoke administrative actions without authorization.
What components are involved in CVE-2025-70141?
CVE-2025-70141 involves the ajax.php and admin_class.php files within the SourceCodester Customer Support System.