PT-2026-20464 · Sourcecodester · Sourcecodester Customer Support System

Published 2026-02-18 · Updated 2026-02-18 · CVE-2025-70141

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Customer Support System version 1.0

Description The application has an access control issue in the ajax.php file. The AJAX dispatcher does not verify authentication or authorization before calling administrative methods within admin class.php using the action parameter. This allows a remote, unauthenticated attacker to perform sensitive actions, including creating customers, deleting users (including the administrator account), and modifying or deleting application data like tickets, departments, and comments, leading to unauthorized data changes. The vulnerable parameter is action.

Recommendations Apply updates to address the access control flaw in ajax.php. Restrict access to admin class.php to authenticated and authorized users only. Implement proper authentication and authorization checks within the AJAX dispatcher before invoking administrative methods.

Exploit

Fix

Missing Authentication

Missing Authorization

Weakness Enumeration

CWE-306

CWE-862

Related Identifiers

CVE-2025-70141

Affected Products

Sourcecodester Customer Support System

References · 5

• 🔥 https://youngkevinn.github.io/posts/CVE-2025-70141-Customer-Support-BAC · Exploit
• https://osv.dev/vulnerability/CVE-2025-70141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70141 · Security Note
• https://sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code · Note
• https://twitter.com/CVEnew/status/2024172400519029037 · Twitter Post