Executive brief
The Student Management System, used to manage student records and course enrollments, stores a database backup file (example.7z) in a web-accessible location. An unauthenticated attacker can download this archive to access sensitive student data including personal identity numbers, password hashes, course records, and administrative credentials, enabling privacy violations and potential account takeover.
Technical details
The vulnerability is an information disclosure flaw caused by improper access controls on backup files in the Backup Handler component. The unencrypted example.7z archive is stored in the repository root, which is served as the default application document-root, making it retrievable via a simple HTTP GET request without authentication. The archive contains a full SQL export (example.sql) with 997 student records, 997 password hashes, personal identity data (18-digit values), 3,982 course-selection records, and administrative credentials. The attack requires only network access and no authentication; an attacker can directly download the file using standard tools like curl. The project was notified via issue report but has not yet responded or released a patch.
Affected products
- ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf
Timeline
- 2026-07-29: disclosed: Issue reported on GitHub by ThanatosXingYu
- 2026-09-08: advisory: CVE-2026-86672 published