Executive brief
The SourceCodester Student Grades Management System, a web application used to track and manage academic performance, contains a security flaw in its grading module. An attacker can manipulate student identification parameters to bypass authorization checks. This could allow unauthorized users to view or modify sensitive student grade information, potentially compromising the integrity of academic records.
Technical details
An improper authorization vulnerability exists in SourceCodester Student Grades Management System 1.0 within the grades.php file. The application fails to properly validate the 'student_id' parameter, allowing an authenticated user to access or modify records belonging to other students. This is classified as an Incorrect Privilege Assignment (CWE-266) or Improper Authorization (CWE-285) issue. An attacker with low-level privileges can initiate this attack remotely over the network. Public exploit documentation exists, increasing the risk of exploitation. No official patch has been confirmed at this time.
Affected products
- SourceCodester Student Grades Management System 1.0
Timeline
- 2026-05-25: disclosed: Initial vulnerability report and public exploit disclosure.
- 2026-05-25: advisory: NVD published CVE-2026-9483.