Executive brief
StudentManage is a web-based application used for managing student records, grades, and administrative accounts. A security flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as adding new student records without their knowledge. This could lead to unauthorized data entry and compromise the integrity of the student database.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in StudentManage v1.0 within the 'add student' interface (com.dayrain.controller.addStudentController). The application fails to implement anti-CSRF tokens or other validation mechanisms to verify the origin of requests. An attacker can exploit this by crafting a malicious link or web page that, when visited by an authenticated administrator, triggers a GET request to /admin/addStudent with arbitrary parameters. This results in the unauthorized creation of student records in the system database. No patches are currently documented for this open-source project.
Affected products
- DayCloud (DayRain) StudentManage 1.0
Timeline
- 2025-07-18: disclosed: Vulnerability details and PoC published on GitHub/Gitee
- 2025-07-18: advisory: CVE-2025-50586 published