Access Control Flaw in SourceCodester Customer Support System
CVE-2025-70141

9.4CRITICAL

Key Information:

Vendor

SourceCodester
Status
Customer Support System
Vendor
CVE Published:
18 February 2026

What is CVE-2025-70141?

An access control vulnerability in the SourceCodester Customer Support System 1.0 allows unauthenticated remote attackers to invoke administrative functions without proper authentication or authorization. The vulnerability exists in the ajax.php file, where the AJAX dispatcher fails to enforce necessary security checks. This oversight permits attackers to execute sensitive operations such as creating customer accounts and deleting users, including the admin account. Additionally, it enables modifications or deletions of various application records, including tickets and comments, which can lead to significant data integrity issues.

References

https://www.sourcecodester.com/download-code?nid=14587&ti...
https://youngkevinn.github.io/posts/CVE-2025-70141-Custom...

CVSS V3.1

Score:
9.4
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.