Executive brief
A vulnerability in the Hostel Management System allows regular student users to access the administrative dashboard. This system is used to manage student registrations, room allotments, and complaints. An attacker with a standard student account could view sensitive student records, modify room assignments, and access other administrative functions, potentially disrupting hostel operations and exposing private data.
Technical details
A missing authorization vulnerability exists in LakshayD02 Hostel-Management-System-PHP up to commit f87e67c283bab6f718faf2fec6ae39a13bd7036b. The root cause is located in the 'checklogin.php' helper used by administrative pages, which only verifies if a session ID exists but fails to validate if the session belongs to an administrator. Because the application uses the same 'id' session variable for both students and admins, any authenticated student can bypass access controls to reach 'admin/dashboard.php' and other management files. An attacker can use this to view student profiles, manage courses, and modify room data. As of the advisory date, no official patch has been released.
Affected products
- LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b
Timeline
- 2026-05-17: disclosed: Issue reported on GitHub repository
- 2026-06-04: advisory: CVE published via VulDB/NVD