CVE-2023-49981 is a high severity (CVSS 7.5) directory listing flaw in School Fees Management System 1.0, a PHP and CodeIgniter project. Anyone can list folders and sensitive files without logging in. No fix is named, so disable listing or take the application offline.
What's affected
The record names School Fees Management System 1.0 from oretnom23, distributed on SourceCodester. The weaknesses are CWE-862 (missing authorization) and CWE-200 (exposure of sensitive information to an unauthorized actor). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
The description says attackers can list directories and sensitive files within the application without authorization. Fixed versions: none named. The references are a researcher page and the project page, and neither names a fix.
A fees system holds family names, payment records and contact details, which makes exposure a privacy matter as well as a security one.
How to check if you're exposed
Find out whether you run this application. It is a downloadable sample project, often used for learning or small internal tools, so it may sit on a forgotten server.
grep -ril "sourcecodester" /var/www 2>/dev/null | head
Check your upload and storage folders for files that should not be public, such as exports and backups. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find every copy of the application and decide whether it is still needed.
- If it is not needed, remove it. A sample project is rarely worth keeping online.
- If it must stay, put it behind a login at the web server and restrict it to trusted networks.
- Turn off directory listing in the web server and block access to upload, backup and configuration folders.
- Review the data the application holds and treat anything exposed as readable by others.
- Do not reuse passwords from this application anywhere else.
Why it matters
The weakness is simple. A folder holds files, the server shows an index of them, and nothing asks who is looking. Listings are the first thing a curious visitor finds and often lead to backups and config files.
Fixing it is a few lines of web server configuration, and the broader fix is to stop running unmaintained sample projects with real data. This CVE is not on the CISA KEV list.
Quick check
Is there a patch?
None is named in the sources I read.
Does exposure need an account?
No. The vector shows no privileges required.
Sources
Last reviewed: 19 October 2026.
