CVE-2026-9582

Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0. The application does not properly validate authenticated POST requests, allowing attackers to perform unauthorized actions on behalf of authenticated users. The affected endpoints are /index.php?action=manage_subjects and /index.php?action=add_grade [3].

Exploitation

An attacker can craft a malicious HTML page that, when visited by an authenticated user, automatically submits POST requests to the vulnerable endpoints. This is possible because the application lacks anti-CSRF tokens, origin/referer header validation, or SameSite cookie protections [3]. The attacker does not require prior authentication or any special network position; they simply need to trick a logged-in victim into visiting the malicious page (e.g., via a phishing link or forum post). The public proof-of-concept HTML file demonstrates this attack [1].

Impact

A successful CSRF attack enables an attacker to create unauthorized subjects or manipulate grading-related data without the victim's consent. The impact is limited to integrity compromise (CWE-352) with no effect on confidentiality or availability. The CVSS v3.1 score is 4.3 (Medium) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N [3].

Mitigation

The vendor has not yet released a patched version. The published advisory recommends implementing anti-CSRF tokens, validating Origin and Referer headers, and using SameSite cookie protections for all sensitive actions [3]. Until a fix is available, administrators should consider deploying web application firewall rules to block unexpected POST requests or requiring re-authentication for sensitive operations. Affected users should monitor SourceCodester's official website [2] for future updates.