Executive brief
The Student Grades Management System, a web application used for tracking academic performance, is vulnerable to a security flaw that allows unauthorized actions. By tricking an authenticated user (such as a teacher or administrator) into clicking a malicious link, an attacker can perform actions on their behalf without their consent. This could lead to unauthorized changes to student records or system settings, potentially compromising the integrity of academic data.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in SourceCodester Student Grades Management System 1.0 due to missing authorization checks and lack of anti-CSRF tokens. An attacker can exploit this by crafting a malicious web page or link that, when visited by an authenticated user, triggers unintended requests to the application. Because the application fails to verify that the request was intentionally initiated by the user, the attacker can perform state-changing operations (such as modifying grades or user accounts) with the privileges of the victim. The attack requires network connectivity to the application and minimal user interaction. Public exploit documentation has been released.
Affected products
- SourceCodester Student Grades Management System 1.0
Timeline
- 2026-05-25: disclosed: Vulnerability reported and exploit released publicly.
- 2026-05-25: advisory: NVD and VulDB published advisory details.