Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
SourceCodester Customer Support System allows unauthorized admin access
CVE-2025-70141
Summary
An attacker can exploit this flaw to create, delete, or modify customer data without permission. This could lead to sensitive information being altered or deleted, compromising the integrity of the system. Update the software to the latest version to address this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| oretnom23 | customer_support_system | 1.0 | – |
Original title
SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking admin...
Original description
SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parameter. An unauthenticated remote attacker can perform sensitive operations such as creating customers and deleting users (including the admin account), as well as modifying or deleting other application records (tickets, departments, comments), resulting in unauthorized data modification.
nvd CVSS3.1
9.4
Vulnerability type
CWE-306
Missing Authentication for Critical Function
CWE-862
Missing Authorization
- https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+Sy... Product
- https://youngkevinn.github.io/posts/CVE-2025-70141-Customer-Support-BAC/ Exploit Mitigation Third Party Advisory
Published: 18 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026