---
id: CVE-2025-70141
title: >-
  SourceCodester Customer Support System 1.0 contains an incorrect access
  control vulnerability in ajax.php
summary: >-
  SourceCodester Customer Support System 1.0 contains an incorrect access
  control vulnerability in ajax.php. The AJAX dispatcher does not enforce
  authentication or authorization before invoking administrative methods in
  admin_class.php bas…
severity: critical
cvss: 9.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H'
cwe:
  - CWE-306
  - CWE-862
vendor: oretnom23
product: customer_support_system
affected:
  - customer_support_system = 1.0
published: '2026-02-18'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:17:27.277'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-70141'
references:
  - url: 'https://0x0bito.github.io/posts/CVE-2025-70141-Customer-Support-BAC/'
    label: cve@mitre.org
  - url: >-
      https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code
    label: cve@mitre.org
  - url: 'https://youngkevinn.github.io/posts/CVE-2025-70141-Customer-Support-BAC/'
    label: cve@mitre.org
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-02-18T18:30:51.483296Z'
epss: 0.00688
epssPercentile: 0.50594
ingestedAt: '2026-09-08T20:10:03.221Z'
---

## Overview

SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parameter. An unauthenticated remote attacker can perform sensitive operations such as creating customers and deleting users (including the admin account), as well as modifying or deleting other application records (tickets, departments, comments), resulting in unauthorized data modification.

## Affected

- `customer_support_system = 1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.