CVE-2023-49979 is a high severity (CVSS 7.5) directory listing flaw that lets anyone list folders and sensitive files without logging in. The record text names Customer Support System v1, while its product data names Best Student Management System 1.0. No fix is named, so restrict or remove the application.
What's affected
Source conflict on the product: the record's description says Customer Support System v1, while its affected product data names mayurik Best Student Management System 1.0. The reference points to a SourceCodester page for Best Student Result Management System. Treat all of these SourceCodester PHP projects as in scope until you can confirm which one you run.
The weaknesses are CWE-862 (missing authorization) and CWE-548 (exposure of information through directory listing). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: no login, high confidentiality impact.
Fixed versions: none named. The researcher's page was the only detail source and I did not fetch it separately for this CVE. Check it and the project page for current status.
How to check if you're exposed
Find out whether you run this application. It is a downloadable sample project, often used for learning or small internal tools, so it may sit on a forgotten server.
grep -ril "sourcecodester" /var/www 2>/dev/null | head
Request a folder path on your own server without a file name, and see whether it returns a list of files. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find every copy of the application and decide whether it is still needed.
- If it is not needed, remove it. A sample project is rarely worth keeping online.
- If it must stay, put it behind a login at the web server and restrict it to trusted networks.
- Turn off directory listing in the web server and block access to upload, backup and configuration folders.
- Review the data the application holds and treat anything exposed as readable by others.
- Do not reuse passwords from this application anywhere else.
Why it matters
A web server that lists folder contents shows file names to anyone who asks. If those folders hold uploads, backups, configuration files or database dumps, listing them is as good as handing them out.
The record gives no more detail than that. This CVE is not on the CISA KEV list.
Quick check
Which product does this CVE cover?
The record is inconsistent. Its description says Customer Support System v1 and its product data says Best Student Management System 1.0.
Is a login needed?
No. The vector shows no privileges.
Sources
Last reviewed: 19 October 2026.
