Cyber Posture

CVE-2024-54818

High

Published: 08 January 2025

Published
08 January 2025
Modified
16 April 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0009 26.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-54818 is a high-severity Improper Preservation of Permissions (CWE-281) vulnerability in Oretnom23 Computer Laboratory Management System. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

AC-3 enforces approved authorizations for access to system resources, directly preventing low-privileged users from reaching the vulnerable /php-lms/admin/?page=user/list endpoint.

prevent

AC-25 implements a reference monitor to mediate and enforce access control policy over all subjects and objects, comprehensively addressing the incorrect access control implementation in this CVE.

prevent

AC-6 applies least privilege to restrict low-privileged (PR:L) accounts from performing high-impact unauthorized actions on user management functions.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1087.001 Local Account Discovery
Adversaries may attempt to get a listing of local system accounts.
Why these techniques?

Incorrect access control in public-facing web app (/php-lms/admin/?page=user/list) enables exploitation for initial access (T1190) and unauthorized local account discovery (T1087.001).

NVD Description

SourceCodester Computer Laboratory Management System 1.0 is vulnerable to Incorrect Access Control. via /php-lms/admin/?page=user/list.

Deeper analysisAI

CVE-2024-54818 is an Incorrect Access Control vulnerability (CWE-281) in SourceCodester Computer Laboratory Management System 1.0, accessible via the /php-lms/admin/?page=user/list endpoint. Published on 2025-01-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to its potential for significant impact.

An attacker with low privileges (PR:L) can exploit this remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) without changing scope (S:U), potentially allowing unauthorized actions on user management functions.

Advisories and references include vulnerability research details at https://github.com/CloseC4ll/vulnerability-research/tree/main/CVE-2024-54818 and general guidance on preventing access control vulnerabilities from PortSwigger at https://portswigger.net/web-security/access-control#how-to-prevent-access-control-vulnerabilities. No specific patches are detailed in the provided information.

Details

CWE(s)

Affected Products

oretnom23
computer laboratory management system
1.0

CVEs Like This One

CVE-2026-3770Same product: Oretnom23 Computer Laboratory Management System
CVE-2026-30529Same vendor: Oretnom23
CVE-2026-30530Same vendor: Oretnom23
CVE-2026-3771Same vendor: Oretnom23
CVE-2026-26705Same vendor: Oretnom23
CVE-2026-30532Same vendor: Oretnom23
CVE-2026-26707Same vendor: Oretnom23
CVE-2026-3746Same vendor: Oretnom23
CVE-2026-2848Same vendor: Oretnom23
CVE-2025-0173Same vendor: Oretnom23

References