Executive brief
XueZhiSi Open Source Exam System is an educational platform used to administer and manage online exams. An authenticated attacker with access to the teacher interface can manipulate the role parameter in API requests to escalate their privileges and gain unauthorized access to administrative functions or teacher accounts they should not have access to.
Technical details
The vulnerability is a privilege escalation flaw in the teacher-end interface endpoint POST /api/teacher/user/page/list. The UserPageRequestVM data model fails to properly validate or restrict the role parameter, allowing an attacker to directly control and modify this value in requests. An authenticated user making requests to this endpoint can inject arbitrary role values to bypass authorization checks and access functionality reserved for higher-privileged accounts. The vulnerability requires an authenticated attacker with at least teacher-level access to the system.
Affected products
- XueZhiSi Open Source Exam System <=3.9.0
Timeline
- 2026-08-31: disclosed
- 2026-06-24: other: Security advisory and patch details committed