CVE-2026-13549 · CodeAstro Complaint Management System 1.0 — Unauthenticated Report…

01 · The Real Story

Someone found a missing lock on a school locker that nobody uses and filed a federal report

CVE-2026-13549 is an authorization bypass (IDOR) in the deletereport function of application/controllers/Report.php in CodeAstro Complaint Management System 1.0. An unauthenticated attacker can send a crafted HTTP request to the Report Endpoint, manipulating the id parameter to delete arbitrary complaint reports and associated files. Both CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key) apply. Only version 1.0 is affected — and it is the only version that exists. No vendor patch has been released, and given the nature of the product, one is unlikely to materialize.

The vendor CVSS of 5.4 MEDIUM is technically defensible for the bug class — an unauthenticated IDOR that deletes records remotely is a real flaw. But severity scoring in a vacuum is meaningless without deployment context. CodeAstro's own product page describes this system as a project for "second-year IT students for their college projects." It ships as a 6.57 MB ZIP file running PHP 5.6/7.4 on CodeIgniter with MySQL. CodeAstro has 158 CVEs across 37 products — all educational PHP demos that are routinely CVE-farmed by researchers building portfolios. Zero enterprise deployment footprint, zero Shodan/Censys/FOFA exposure, zero GreyNoise scan traffic. The vendor score accurately describes the *bug*; it wildly overstates the *risk* to any organization running an asset inventory.

"A homework project with a missing auth check — this is CVE noise, not an enterprise risk."

02 · The Attack Path

3 steps from start to impact.

STEP 01

Locate an exposed instance

The attacker must find an internet-facing (or internal network) instance of CodeAstro Complaint Management System 1.0 running on a web server. This requires the target organization to have deliberately downloaded, configured, and deployed this educational PHP project. Given the product's nature, this is the hardest step in the chain.

Conditions required:

Target organization has deployed CodeAstro Complaint Management System 1.0 in a reachable environment

Where this breaks in practice:

The product is a student demo project — enterprise deployment is effectively zero
No known Shodan/Censys/FOFA fingerprints for this application
PHP 5.6/7.4 on CodeIgniter is not a stack any modern enterprise deploys intentionally

Detection/coverage: No Shodan/Censys/FOFA/GreyNoise signatures exist for this application. Any web application scanner that crawls endpoints would find it, but you'd have to be scanning for it specifically.

STEP 02

Enumerate valid report IDs

The attacker needs valid id parameter values to target specific complaint reports for deletion. Since the IDOR has no authentication, the attacker can iterate through sequential integer IDs. The PoC by ashikmd0507 (GitHub: ashikmd0507/CVE) demonstrates this direct parameter manipulation against the /report/deletereport endpoint.

Conditions required:

Network access to the Report Endpoint
Knowledge of or ability to brute-force sequential integer IDs

Where this breaks in practice:

Sequential ID guessing is trivial if the app is reachable — no real friction here

Detection/coverage: WAF rules detecting rapid sequential parameter iteration on the /report/deletereport path would catch brute-force enumeration. Standard PHP application logging would record the DELETE requests.

STEP 03

Send unauthenticated DELETE request

The attacker sends an HTTP request to the deletereport function in Report.php with a valid id parameter. No session cookie, no auth token, no CSRF token is required. The server processes the deletion and removes the complaint report and any associated files from the MySQL database and filesystem.

Conditions required:

Valid report ID
HTTP access to the endpoint

Where this breaks in practice:

Impact is limited to deletion of complaint records — no code execution, no data exfiltration, no lateral movement
The data being deleted is student-project complaint records, not regulated or sensitive enterprise data

Detection/coverage: Application-layer logging of the deletereport function, if enabled. Database audit logs showing DELETE statements against the reports table.

03 · Compensating Control

IGNORE 1.5→IGNORE 0.0

Confirm the software is not in your asset inventory — Run a software inventory query for *CodeAstro Complaint Management System* or the file path application/controllers/Report.php within a CodeIgniter deployment. If your CMDB, SBOM, or endpoint agent returns zero matches — which it almost certainly will — document the result and close the ticket. This is the only action required. No noisgate mitigation or remediation SLA applies to IGNORE-tier findings.

IGNORE 1.5→IGNORE 0.0

If somehow deployed: take it offline immediately — In the extraordinarily unlikely event that someone has deployed this educational PHP project on your network, remove it. It has 5+ unpatched CVEs including critical privilege escalation (CVE-2024-55507, CVSS 9.8). The authorization bypass in this CVE is the *least* of your problems. This is unmaintained student code running on PHP 5.6. Kill it with fire.

What doesn't work

Patching: No vendor patch exists, and none is expected. The product is an unmaintained educational demo.
WAF rules: You could write a WAF rule for the /report/deletereport endpoint, but if you're running a WAF in front of a student PHP project, your architecture has bigger problems.
Network segmentation: Segmenting an application that shouldn't exist on your network is solving the wrong problem.

04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	None observed. Not listed in CISA KEV. No GreyNoise scan traffic. No known campaigns targeting CodeAstro products. This is a CVE-farm target, not an actively exploited product.
Proof-of-concept	Public. PoC published by researcher Ashik Mohamed (`ashikmd0507`) on GitHub at `ashikmd0507/CVE` — directory titled Unauthenticated Arbitrary Report & File Deletion. The researcher has filed multiple CVEs against CodeAstro educational products (CVE-2026-11491, CVE-2026-13537, CVE-2026-13558).
EPSS score	0.00511 (~0.5%) — bottom of the distribution. The exploitation probability model confirms this is noise-tier.
KEV status	Not listed. No CISA KEV entry. No federal mandate to patch.
CVSS vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L` — Network vector, no privileges, but requires user interaction (questionable for a direct IDOR). No confidentiality impact. Low integrity and availability only. CVSS v4.0: 5.3 with exploit maturity Proof-of-concept (not weaponized).
Affected versions	CodeAstro Complaint Management System 1.0 (the only version that exists). PHP 5.6 or 7.4 on CodeIgniter with MySQL.
Fixed version	None. No vendor patch has been released. The product's CodeAstro page has no changelog or update history. Fix is unlikely — this is an unmaintained educational project.
Exposure data	Zero measurable internet footprint. No Shodan, Censys, FOFA, or GreyNoise signatures or results for this application. The product is a 6.57 MB ZIP download for PHP student projects.
Vendor profile	CodeAstro is a publisher of educational PHP source code projects for students. They have 158 CVEs across 37 products — a textbook CVE-farm vendor. Products include Gym Management System, Real Estate Management System, Membership Management System, etc. — all student demos.
Reporting researcher	Ashik Mohamed (`ashikmd0507` on GitHub). Active CVE-farming researcher targeting CodeAstro and similar educational PHP project vendors. Has published multiple PoCs for XSS, CSRF, and IDOR flaws in CodeAstro products.

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to IGNORE (1.5/10)

Why this verdict

Zero enterprise deployment footprint: CodeAstro Complaint Management System is explicitly described by its own vendor as a project for *"second-year IT students for their college projects."* It ships as a 6.57 MB ZIP file. No enterprise runs this in production. There are zero Shodan/Censys/FOFA/GreyNoise signatures. The vendor CVSS scores the *bug*, but defenders score *risk to their fleet* — and the risk is zero if the software isn't deployed.
CVE-farm noise: CodeAstro has 158 CVEs across 37 educational PHP projects. This is a well-known pattern where security researchers file CVEs against trivially vulnerable student demo code to build publication counts. These CVEs are technically valid but operationally irrelevant to enterprise patching queues. Every minute spent triaging this is a minute not spent on real threats.
Impact ceiling is data deletion only: Even in the impossible scenario where this *is* deployed, the attack chain ends at deleting complaint records from a MySQL database. No code execution. No confidentiality breach. No lateral movement. No privilege escalation beyond the application. The blast radius is confined to a single toy application's data.
Role multiplier: This component occupies no high-value deployment role whatsoever. It is not an identity provider, hypervisor, CI/CD system, database engine, backup solution, EDR agent, network edge appliance, or any other component in the high-value role catalog. It is a student PHP project. The high-value-role floor does not apply because 0% (not ≥1%) of the installed base occupies any high-value role — the installed base in enterprise environments is effectively zero. The IGNORE verdict is unconstrained by any floor.
EPSS confirms irrelevance: At 0.00511 (~0.5%), the exploitation probability model agrees this will not be weaponized against real targets. No KEV listing. No campaign activity. No scanner coverage to even detect it.

Why not higher?

There is no scenario in which this warrants any enterprise attention. The product has zero enterprise deployment, zero internet exposure, and the maximum impact is deletion of student project complaint records. Assigning even LOW would imply it belongs on a backlog — it does not.

Why not lower?

IGNORE is the lowest tier. The CVE is technically valid — the authorization bypass is real and the PoC works. It simply has no relevance to any organization managing production infrastructure.

06 · Verification

Crowdsourced verification payload.

Run this on any Linux/macOS auditor workstation with find and shell access to your web server fleet (or pipe through your asset inventory API). No special privileges needed beyond read access to the filesystem or your CMDB export. Example: bash check_cve_2026_13549.sh /var/www or bash check_cve_2026_13549.sh /opt/lampp/htdocs.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_cve_2026_13549.sh — CVE-2026-13549 presence check
# CodeAstro Complaint Management System 1.0 — IDOR in Report.php deletereport
# Usage: bash check_cve_2026_13549.sh <webroot_path>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED/NOT FOUND, 2 = UNKNOWN

set -euo pipefail

WEBROOT="${1:-/var/www}"

if [ ! -d "$WEBROOT" ]; then
  echo "UNKNOWN — directory $WEBROOT does not exist or is not accessible."
  exit 2
fi

# Look for the vulnerable controller file
HITS=$(find "$WEBROOT" -type f -path '*/application/controllers/Report.php' 2>/dev/null || true)

if [ -z "$HITS" ]; then
  echo "PATCHED — CodeAstro Complaint Management System not found under $WEBROOT."
  echo "No instance of application/controllers/Report.php detected."
  exit 1
fi

# Check each hit for the vulnerable deletereport function without auth
for f in $HITS; do
  if grep -q 'function deletereport' "$f" 2>/dev/null; then
    # Check if there's any session/auth check before the delete logic
    # CodeAstro's vulnerable version has no auth guard in this function
    AUTH_CHECK=$(grep -c -E '(session|logged_in|auth|is_logged|check_login)' "$f" 2>/dev/null || echo "0")
    if [ "$AUTH_CHECK" -lt 1 ]; then
      echo "VULNERABLE — Found unprotected deletereport function in:"
      echo "  $f"
      echo "CVE-2026-13549: Unauthenticated report deletion via IDOR."
      echo "Action: Remove this application from production immediately."
      exit 0
    else
      echo "PATCHED — deletereport function found but appears to have auth checks in:"
      echo "  $f"
      exit 1
    fi
  fi
done

echo "PATCHED — Report.php found but no deletereport function present."
exit 1