CVE-2026-11552: SourceCodester Onlne Examination & Learning Management System import_users.php hard-coded password
A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System and Syllabus-aligned Learning Management and Examination System 1.0. Affected by this issue is some unknown functionality of the file importusers.php. The manipulation of the argument rawpassword with the input CICT2026 leads to use of hard-coded password. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SourceCodester Onlne Examination & Learning Management System / Syllabus-aligned Learning Management and Examination System 1.0from your environment.If the product or the import_users.php functionality is not required, uninstall the product or remove/disable the import_users.php file to eliminate the vulnerability until a secure code fix is applied.
- Configuration
Remove the hard-coded password logic from import_users.php. Do not accept a raw_password parameter that results in a universal/hard-coded password (for example the value 'CICT_2026'). Ensure passwords are assigned per-user through secure, explicit input or generation.
import_users.php (SourceCodester Onlne Examination & Learning Management System / Syllabus-aligned Learning Management and Examination System 1.0) raw_password hard-coded handling = remove hard-coded password - Compensating control
Until the code is fixed, restrict remote access to import_users.php and administrative interfaces (for example via firewall rules, IP allowlisting, or a web application firewall) and/or disable the import endpoint to prevent remote exploitation.
- Operational
Rotate/reset any credentials that may have been set to the hard-coded password (for example 'CICT_2026'). Invalidate active sessions and require affected users to choose new secure passwords.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11552?
The severity of CVE-2026-11552 is rated as medium with a score of 5.3.
How do I fix CVE-2026-11552?
To fix CVE-2026-11552, it is recommended to update the SourceCodester Online Examination & Learning Management System to the latest version that addresses this hard-coded password vulnerability.
What software is affected by CVE-2026-11552?
CVE-2026-11552 affects the SourceCodester Online Examination & Learning Management System and the SourceCodester Syllabus-aligned Learning Management and Examination System.
What is the main issue with CVE-2026-11552?
The main issue with CVE-2026-11552 is the presence of a hard-coded password in the import_users.php file, which could lead to unauthorized access.
When was CVE-2026-11552 published?
CVE-2026-11552 was published on June 8, 2026.