Executive brief
The ProjectsAndPrograms school management system, used for managing student and teacher records, uses a predictable password generation method based on a user's date of birth. Because the system does not force users to change these passwords, an attacker can easily guess login credentials to gain unauthorized access to school accounts. This could lead to the exposure of sensitive student and staff information or unauthorized changes to school records.
Technical details
The school-management-system application suffers from a weak credential vulnerability (CWE-1391) where student and teacher passwords are automatically generated using only the user's date of birth (DDMMYYYY format). The application lacks a mechanism to force or prompt a password change upon the first login, leaving accounts vulnerable indefinitely. A remote, unauthenticated attacker can derive valid credentials if they possess or can guess a user's birth date. This vulnerability was confirmed in the version corresponding to commit 6b6fae5. While the maintainers were notified, no official patch or version information has been provided.
Affected products
- ProjectsAndPrograms school-management-system commit 6b6fae5 and potentially others
Timeline
- 2026-06-03: disclosed: Vulnerability disclosed by CERT Polska
- 2026-06-03: advisory: CVE-2026-47325 published