Executive brief
A security vulnerability exists in the StudentManagementSystem software that allows logged-in users to delete course records they do not own or have permission to manage. This system is used to handle large student and course records, and an exploit could lead to unauthorized data loss and disruption of academic operations. An attacker can trigger this by sending a specifically crafted web request to the course deletion component.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in courseDel.php due to improper validation of user permissions before executing database operations. The application processes the 'id' parameter from a GET request and executes a SQL DELETE statement without verifying if the authenticated session has administrative privileges or ownership of the record. A remote attacker with low-level 'client' credentials can exploit this to delete any course record by manipulating the ID value. Additionally, the vulnerable code snippet indicates a lack of parameterized queries, making the component susceptible to SQL injection. As of the advisory date, no official patch has been released by the maintainer.
Affected products
- yashpokharna2555 StudentManagementSystem commit cb2f558ddf8d19396de0f92abf2d224d46a0a203
Timeline
- 2026-04-27: disclosed: Issue reported on GitHub repository
- 2026-05-25: advisory: CVE published by VulDB/NVD