# CVE-2026-97647: ningzichun student-management-system authorization bypass in user/editLog.php

Source: https://junglewise.ai/threats/cve-2026-97647-a-security-vulnerability-has-been-detected-in-ningzichun-student  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-97647 · Severity: medium · CVSS 5.3 · Published 2026-09-25

The student-management-system is a web application used to manage student course selection and disciplinary records. An unauthenticated attacker can directly modify student reward and disciplinary records by sending a simple HTTP POST request without needing valid login credentials, potentially corrupting student histories and academic records.

Technologies: [Ningzichun Student-Management-System](https://junglewise.ai/threats/technologies/ningzichun-student-management-system). Vendors: [Ningzichun](https://junglewise.ai/threats/vendors/ningzichun).

## Quick answers

**Is CVE-2026-97647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97647 being exploited in the wild.

**How severe is CVE-2026-97647?** Medium severity, with a CVSS score of 5.3, published 25 September 2026.

**Which products and versions are affected?** Ningzichun Student-Management-System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf.

**Is there a fix for CVE-2026-97647?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97647 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97647?** Check whether you run Ningzichun Student-Management-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in user/editLog.php that accepts POST parameters (sid, type, reason, detail, logdate, addtime) with no session validation, login check, or ownership verification. An unauthenticated attacker can send a POST request with arbitrary student IDs and values to update database records directly. The vulnerable code constructs a SQL update query directly from POST parameters without authentication gates, allowing remote unauthorized modification of student logs.

## Affected products

- ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf

## Timeline

- 2026-07-18: disclosed: Issue reported on GitHub by ThanatosXingYu
- 2026-09-25: advisory: CVE-2026-97647 published

## References

- [https://github.com/ningzichun/student-management-system/](https://github.com/ningzichun/student-management-system/)
- [https://github.com/ningzichun/student-management-system/issues/10](https://github.com/ningzichun/student-management-system/issues/10)

## Related threats

- [ningzichun student-management-system stored cross-site scripting in log](https://junglewise.ai/threats/cve-2026-97650-a-vulnerability-has-been-found-in-ningzichun-student-management)
- [ningzichun student-management-system default credentials in sample database](https://junglewise.ai/threats/cve-2026-97649-a-flaw-has-been-found-in-ningzichun-student-management-system-up)
- [ningzichun student-management-system CSRF in course withdrawal](https://junglewise.ai/threats/cve-2026-97648-a-vulnerability-was-detected-in-ningzichun-student-management)
- [Ningzichun student-management-system authorization bypass in admin handlers](https://junglewise.ai/threats/cve-2026-97646-a-weakness-has-been-identified-in-ningzichun-student-management)