Executive brief
A vulnerability in the CodeIgniter-StudentManagementSystem allows unauthorized individuals to access and modify student records. This software is used to manage student data, and the flaw means that anyone with the web address can view, add, or delete student information without needing a username or password. This could lead to the exposure of sensitive student data and the loss of data integrity within the system.
Technical details
The Students controller (application/controllers/Students.php) in the CodeIgniter-StudentManagementSystem fails to implement authentication or authorization checks. This vulnerability class is categorized as Improper Access Control (CWE-284) and Incorrect Privilege Assignment (CWE-266). A remote, unauthenticated attacker can access administrative endpoints such as /index.php/students/addStudentView and /index.php/students/ to perform CRUD operations on student data. The exploit has been publicly disclosed via a GitHub issue, and as the project uses a rolling release model with no official patch yet, all current deployments are likely affected.
Affected products
- hemant6488 CodeIgniter-StudentManagementSystem rolling release
Timeline
- 2026-04-27: disclosed: Vulnerability reported via GitHub issue by user duckpigdog.
- 2026-05-26: advisory: CVE-2026-9517 published.