Description

XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-31T21:17:48.503Z",
  "pubdate": "2026-08-31T21:17:48.503Z",
  "executiveSummary": "The XueZhiSi Open Source Exam System, versions 3.9.0 and below, contains a critical privilege escalation vulnerability located within the teacher-end API.\nThe vulnerability stems from improper input validation regarding user role assignment during page retrieval requests. An authenticated attacker can manipulate the 'role' parameter to perform unauthorized actions or gain elevated administrative privileges within the system.\nThe flaw resides specifically in the POST /api/teacher/user/page/list endpoint, where the UserPageRequestVM object fails to adequately sanitize or enforce role restrictions. This allows a standard teacher-level account to potentially access or modify data reserved for higher-privileged roles.\nSuccessful exploitation allows for horizontal or vertical privilege escalation, granting the attacker unauthorized access to sensitive exam data, user management functions, or system configurations. This vulnerability poses a severe risk to data integrity and system confidentiality. Exploitation requires an authenticated session on the teacher-end interface, making the attack vector a high-risk concern for institutions utilizing the platform.\nThe vulnerability highlights a lack of server-side authorization enforcement, allowing client-controlled parameters to dictate access control logic, which is a significant security oversight in enterprise-level educational software.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of the Data Transfer Object (DTO) pattern within the XueZhiSi system, specifically in the UserPageRequestVM class associated with the POST /api/teacher/user/page/list endpoint.\nDuring the processing of the request, the application relies on the 'role' field provided within the JSON payload of the HTTP POST request to filter or query user lists. Because the server-side controller blindly trusts the client-provided 'role' value without re-validating the requester's actual authorization level against the requested role, the system enters an insecure state.\nThe attack flow begins when an authenticated user sends a crafted POST request to /api/teacher/user/page/list. By modifying the 'role' parameter in the UserPageRequestVM, the attacker directs the backend query to retrieve, display, or interact with records belonging to a different privilege level, such as the 'admin' role.\nBecause the system fails to verify that the session user has the authority to view or manipulate users of the target role, the application logic processes the request using the higher-privileged scope provided by the attacker. This effectively bypasses standard Access Control Lists (ACLs) and Role-Based Access Control (RBAC) mechanisms.\nTechnical exploitation typically involves intercepting the request via an HTTP proxy, identifying the UserPageRequestVM structure, and injecting an escalated integer or string value into the 'role' parameter. If the application uses numerical role identifiers, incrementing or brute-forcing these values can lead to complete visibility of the user database.\nPost-exploitation impact is severe, as the attacker can gain oversight of exam results, student information, and instructor credentials. In some instances, this could lead to full system compromise if the escalated access allows the attacker to modify administrative settings or inject malicious content into the exam database.\nThis vulnerability is present in versions 3.9.0 and earlier. It requires an authenticated account, meaning the attack surface is limited to users with existing credentials; however, the impact is exacerbated by the lack of server-side sanity checks, allowing an account with minimal permissions to escalate to maximum privilege levels."
}