Executive brief
A security vulnerability in the SourceCodester Student Result Management System allows sensitive login information to be stored in plain text on the server. This system is used to manage academic records, and this flaw could allow an unauthorized person to access login credentials. If exploited, an attacker could gain unauthorized access to the system, potentially compromising student data and administrative functions.
Technical details
A vulnerability (CWE-312/CWE-313) exists in SourceCodester Student Result Management System 1.0 due to the cleartext storage of sensitive information in the '/login_credentials.txt' file. The issue resides within the HTTP GET Request Handler component, which fails to protect or encrypt credential data stored on disk. A remote, unauthenticated attacker can exploit this by directly requesting the text file over the network, leading to the disclosure of login credentials. This vulnerability has been publicly disclosed, and no official patch is currently documented in the advisory.
Affected products
- SourceCodester Student Result Management System 1.0
Timeline
- 2026-04-05: disclosed: Initial publication of the vulnerability.