This vulnerability affects SourceCodester Onlne Examination & Learning Management System 1.0 and a similarly named product. The issue arises from a hard-coded password ('CICT_2026') used in the import_users.php functionality, which can be triggered remotely by manipulating the raw_password parameter. This allows an attacker to bypass authentication or gain unauthorized access. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known but no official fix or patch has been published.

An attacker can remotely exploit this vulnerability to gain unauthorized access or perform actions as an authenticated user by leveraging the hard-coded password. This may lead to compromise of user accounts or system integrity within the affected learning management system. The lack of required privileges or user interaction increases the risk of exploitation. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to the affected import_users.php functionality or implement compensating controls such as web application firewalls to detect and block attempts to exploit the hard-coded password. Monitor for updates from the vendor regarding patches or official mitigations.