Executive brief
A vulnerability in the Student Management System (SMS) allows unauthorized individuals to access administrative dashboards and perform management tasks without logging in. This software is used by schools to track student data, grades, and teacher information. An attacker could exploit this to view sensitive student records or modify and delete school data, potentially leading to significant data breaches or operational disruption.
Technical details
A broken access control vulnerability exists in the sambitraj STUDENT-MANAGEMENT-SYSTEM through commit 56ba287. The application fails to implement session validation checks across multiple PHP scripts, including admin_dashboard.php, student_dashboard.php, and teacher_dashboard.php, as well as CRUD operation scripts like add_student.php and delete_student.php. While these files initiate a session via session_start(), they do not verify the existence of a valid session variable (e.g., $_SESSION['email']). A remote, unauthenticated attacker can bypass the login mechanism by directly requesting these URLs, gaining full access to administrative, teacher, and student functionalities. As of the advisory date, no patch has been released by the maintainer.
Affected products
- sambitraj STUDENT-MANAGEMENT-SYSTEM up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5
Timeline
- 2026-04-29: disclosed: Issue reported on GitHub by user duckpigdog
- 2026-05-26: advisory: NVD/VulDB advisory published