CVE-2020-25514: n/a broken access control

CISO Take

This CVE describes a classic broken access control flaw in the admin login panel (admin.php) of Sourcecodester's Simple Library Management System 1.0, a standalone PHP web application with no AI/ML functionality whatsoever — it appears in this feed under an 'ml_ui' tag that looks like a scraper miscategorization rather than a genuine AI system finding. There is no CVSS score, no CISA KEV listing, no public exploit or Nuclei template, and the EPSS score of 0.00571 (top 57th percentile) indicates low real-world exploitation likelihood. For a CISO, this vulnerability only matters if this specific niche library management product is deployed somewhere in your estate — it has zero blast radius into AI/ML pipelines, model serving, or LLM tooling. Recommended action: confirm via asset inventory whether Sourcecodester LMS is in use; if so, restrict network access to admin.php and enforce session validation, otherwise deprioritize and flag for reclassification out of the AI threat feed.

Sources: NVD EPSS

What is the risk?

Low priority from an AI/ML risk perspective. Severity is officially unrated (no CVSS vector published), EPSS places it in a low-moderate exploitation likelihood band, there is no KEV listing, no public exploit code beyond a PoC reference repo, and no scanner template exists. The primary risk driver is scope — a niche, unmaintained PHP application — not attacker capability or AI-specific exposure.

How does the attack unfold?

Initial Access

Attacker navigates directly to the admin.php endpoint without completing authentication, exploiting missing server-side access control.

AML.T0049

Impact

Attacker obtains unauthorized administrative capabilities within the library management system, such as viewing or modifying records and user accounts.

Initial Access

Attacker navigates directly to the admin.php endpoint without completing authentication, exploiting missing server-side access control.

AML.T0049

Impact

Attacker obtains unauthorized administrative capabilities within the library management system, such as viewing or modifying records and user accounts.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.6%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Verify whether Sourcecodester Simple Library Management System 1.0 is deployed anywhere in the environment via asset inventory. If present: restrict network/firewall access to admin.php to trusted IP ranges, enforce proper session/authentication checks at the application layer (e.g., via a reverse proxy or WAF rule blocking unauthenticated access to admin endpoints), and monitor access logs for direct hits to admin.php without a prior valid login. Given the product's small footprint and unclear vendor patch status, replacing it with a maintained LMS alternative is a reasonable long-term step. No AI-specific detection or mitigation is required.

How is it classified?

Auth Bypass Framework AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2020-25514?

This CVE describes a classic broken access control flaw in the admin login panel (admin.php) of Sourcecodester's Simple Library Management System 1.0, a standalone PHP web application with no AI/ML functionality whatsoever — it appears in this feed under an 'ml_ui' tag that looks like a scraper miscategorization rather than a genuine AI system finding. There is no CVSS score, no CISA KEV listing, no public exploit or Nuclei template, and the EPSS score of 0.00571 (top 57th percentile) indicates low real-world exploitation likelihood. For a CISO, this vulnerability only matters if this specific niche library management product is deployed somewhere in your estate — it has zero blast radius into AI/ML pipelines, model serving, or LLM tooling. Recommended action: confirm via asset inventory whether Sourcecodester LMS is in use; if so, restrict network access to admin.php and enforce session validation, otherwise deprioritize and flag for reclassification out of the AI threat feed.

Is CVE-2020-25514 actively exploited?

No confirmed active exploitation of CVE-2020-25514 has been reported, but organizations should still patch proactively.

How to fix CVE-2020-25514?

Verify whether Sourcecodester Simple Library Management System 1.0 is deployed anywhere in the environment via asset inventory. If present: restrict network/firewall access to admin.php to trusted IP ranges, enforce proper session/authentication checks at the application layer (e.g., via a reverse proxy or WAF rule blocking unauthenticated access to admin endpoints), and monitor access logs for direct hits to admin.php without a prior valid login. Given the product's small footprint and unclear vendor patch status, replacing it with a maintained LMS alternative is a reasonable long-term step. No AI-specific detection or mitigation is required.

What is the CVSS score for CVE-2020-25514?

No CVSS score has been assigned yet.

What is the AI security impact?

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

What are the technical details?

Original Advisory

Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php.

Exploitation Scenario

An unauthenticated attacker directly requests http://<site>/lms/admin.php without ever completing a valid login, exploiting the application's failure to enforce access control on this endpoint. Because the panel does not verify session/authorization state server-side, the attacker gains administrative functionality (e.g., managing library records or users) as if logged in. This is a generic public-facing web application compromise with no AI/ML component or downstream effect on AI systems.