Executive brief
A security flaw exists in the BrinaryBrains School Student Management System, a platform used by educational institutions to manage student records and communications. This vulnerability allows a logged-in parent to view the private academic marks and class schedules of any other student in the system. By simply changing a number in the web address, an unauthorized user can access sensitive student performance data, leading to a significant privacy breach and potential reputational damage for the school.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the 'marks' and 'class_routine' methods of the Parents controller (application/controllers/Parents.php). The application accepts a student ID via the 'param1' URL argument and retrieves the associated records without verifying if the requesting parent is authorized to view that specific student's data. A remote attacker with parent-level authentication can exploit this by enumerating student IDs to perform horizontal privilege escalation. This allows for the unauthorized disclosure of sensitive academic information and class routines. As of the advisory date, the vendor has not responded to the issue report, and no official patch is available.
Affected products
- BrinaryBrains School Student Management System up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6
Timeline
- 2026-05-04: disclosed: Issue reported to the project maintainers on GitHub
- 2026-05-31: advisory: CVE published by VulDB/NVD