Executive brief
The Student Grades Management System, a web application for managing academic records, contains a security flaw in its classroom management module. An attacker with basic user access can manipulate web requests to perform unauthorized actions, such as removing students from classrooms they do not manage. This could lead to data integrity issues and disruption of school administrative operations.
Technical details
An improper authorization vulnerability exists in SourceCodester Student Grades Management System 1.0 within the classroom.php file. The functions getClassroomStudents and removeStudentFromClassroom fail to properly validate user permissions when processing the classroom_id argument. A remote attacker with low-privileged (authenticated) access can manipulate this parameter to view or modify student-classroom associations that should be restricted. This vulnerability is classified under CWE-285 (Improper Authorization) and CWE-266 (Incorrect Privilege Assignment). Exploitation can be performed via direct network requests, and proof-of-concept details have been publicly disclosed.
Affected products
- SourceCodester Student Grades Management System 1.0
Timeline
- 2026-05-25: disclosed: Vulnerability disclosed and CVE assigned
- 2026-05-25: advisory: NVD and VulDB published advisories