The vulnerability in SourceCodester Simple Traffic Offense System 1.0 affects an unspecified function within saveuser.php related to user creation. By manipulating the 'position' argument, an attacker can bypass authentication mechanisms, potentially allowing unauthorized user creation or modification. The vulnerability is remotely exploitable without any privileges or user interaction. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. There is no vendor-provided patch or official remediation information available at this time. Exploit code is publicly known.

An attacker can remotely bypass authentication controls in the user creation process, potentially allowing unauthorized creation or modification of user accounts. This could lead to unauthorized access or privilege escalation within the affected system. The impact on confidentiality, integrity, and availability is rated as low to low, but the ability to bypass authentication remotely makes this a significant risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component saveuser.php, implement additional access controls or network-level restrictions to limit exposure, and monitor for any suspicious activity related to user creation. Avoid deploying the affected version in exposed environments if possible.