CVE-2025-70141: SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php

This week

CRITICAL 9.4REMOTEDOWNGRADE

CVE-2025-70141 is a critical-severity flaw (CVSS 9.4) affecting customer support system. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parameter. An unauthenticated remote attacker can perform sensitive operations such as creating customers and deleting users (including the admin account), as well as modifying or deleting other a

Why this priority

Critical severity
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.4 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.8% (top 45%)
CISA exploited list	No
Weakness	CWE-306, CWE-862
Published	2026-02-18
Last modified	2026-09-08

Publisher (CNA): MITRE · Vendor: oretnom23

Last updated 2026-09-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-02-18 17:21 UTCPublished CVE record published
2026-09-08 20:17 UTCUpdated Record last modified

oretnom23 customer support system DOWNGRADE

Affected: 1.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.0

1. Check installed version

apt-cache policy customer-support-system || rpm -q customer-support-system || customer-support-system --version

2. No fixed release: DOWNGRADE to a release before 1.0 (Debian / Ubuntu)

apt-cache madison customer-support-system sudo apt install customer-support-system=<VERSION_BEFORE_1.0> sudo apt-mark hold customer-support-system

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list customer-support-system sudo dnf downgrade customer-support-system-<VERSION_BEFORE_1.0> sudo dnf versionlock add customer-support-system

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora ELN · intel-ipsec-mb · FIXED · 3.0.1-1.eln159 · FEDORA-2026-ca01077210 · source

sudo dnf upgrade --advisory=FEDORA-2026-ca01077210

Fedora 46 · complytime-providers · FIXED · 0.3.0-2.fc46 · FEDORA-2026-7c372be466 · source

sudo dnf upgrade --advisory=FEDORA-2026-7c372be466

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: 0x0bito.github.io/posts/CVE-2025-70141-Customer-Support-BAC/
Write-up: www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FM
Write-up: youngkevinn.github.io/posts/CVE-2025-70141-Customer-Support-BAC/

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-70141?

customer support system: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2025-70141 being exploited?

CVE-2025-70141 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-70141 affect?

CVE-2025-70141 affects customer support system. Severity is critical (CVSS 9.4). SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based

How urgent is CVE-2025-70141?

Priority 57/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

Software pages

PHP vulnerabilities

Related CVEs

CVE-2025-40729 MEDIUM 6.1 DOWNGRADE Reflected Cross-Site Scripting (XSS) in /customer_support/index.php in Customer Support System v1.0, which all
CVE-2025-40728 HIGH 8.8 DOWNGRADE SQL injection vulnerability in Customer Support System v1.0
CVE-2023-51281 MEDIUM 5.4 DOWNGRADE Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privi
CVE-2023-50071 HIGH 8.8 DOWNGRADE Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/aja
CVE-2023-50070 HIGH 8.8 DOWNGRADE Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/aja

References

← Back to latest CVEs