Executive brief
A vulnerability exists in the a4m4 Student-Management-System, a web application used for managing student records. Due to a lack of security checks, unauthorized individuals can remotely delete student data from the system. This could lead to significant data loss, operational disruption, and a loss of data integrity within the organization.
Technical details
The vulnerability is classified as Improper Authorization (CWE-285) and Incorrect Privilege Assignment (CWE-266) within the 'admin/deleteform.php' script. The root cause is a complete absence of session validation or authentication checks (such as session_start()) before processing database operations. An attacker can send a specially crafted HTTP GET or POST request with a 'sid' parameter to the vulnerable endpoint to execute a SQL DELETE statement against the 'student' table. This allows for unauthenticated, remote, arbitrary data deletion. As of the advisory date, the vendor has not responded to the issue report, and no official patch is available.
Affected products
- a4m4 Student-Management-System up to f0c5f6842c5e8c431ff02b5260a565ca844df3a0
Timeline
- 2026-05-11: disclosed: Issue reported on GitHub repository
- 2026-06-01: advisory: NVD/VulDB advisory published