Executive brief
A student course selection management system fails to validate administrator access in critical administrative functions. An unauthenticated attacker can retrieve student records, reset student passwords, modify grades and enrollment, and alter disciplinary records by sending requests directly to unprotected administrative endpoints.
Technical details
Multiple PHP endpoints in admin/fun/ lack session validation and do not verify administrator role, allowing unauthenticated access. An attacker can manipulate the sid parameter in getStudent.php, resetPassword.php, and addScore.php to retrieve sensitive data, reset passwords to predictable values (derived from student ID), and modify academic records. The vulnerability requires only network access with no authentication or user interaction.
Affected products
- ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf
Timeline
- 2026-07-18: disclosed
- 2026-09-25: advisory