Executive brief
Soarkey StudentManagement is a Java web application used for managing student information. A vulnerability in the user registration function allows attackers to remotely register accounts with arbitrary privilege levels (such as administrator), bypassing normal role assignment controls. This could enable unauthorized access to sensitive student records and system functions.
Technical details
The vulnerability exists in the RegisterServlet.doPost method within the registration workflow (register.html component). The registration endpoint improperly validates the "level" parameter, allowing clients to directly manipulate and set their own privilege level during registration. An attacker can craft a malicious registration request specifying a high privilege level (e.g., administrator) without authentication. The application lacks server-side enforcement of privilege levels, accepting the client-supplied value. This is a privilege escalation vulnerability accessible remotely without authentication. No patched version is currently available, as the project uses commit hashes for versioning and has not responded to the issue report.
Affected products
- Soarkey StudentManagement up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e
Timeline
- 2026-09-14: disclosed
- other: Exploit is publicly available