Description

A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysqli_query of the file student_dashboard.php of the component Student Dashboard. The manipulation of the argument roll_no results in improper authorization. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-30T17:16:39.547Z",
  "pubdate": "2026-08-30T17:16:39.547Z",
  "executiveSummary": "A critical improper authorization vulnerability exists in the sambitraj Student Management System, specifically within the student_dashboard.php component.\nThe vulnerability allows remote attackers to manipulate the 'roll_no' argument, potentially bypassing intended access controls.\nThis flaw resides in the handling of database queries via the mysqli_query function, leading to unauthorized data access or information disclosure.\nThe product utilizes a rolling release model, meaning the vulnerability persists in all versions up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.\nBecause the exploit is publicly available and the vendor has not provided a responsive fix, the risk to deployments is elevated.\nThe vulnerability allows an unauthenticated or low-privileged remote attacker to access student records that should otherwise be restricted based on their session context.\nEffective exploitation requires no specific privilege beyond network access to the target web server.",
  "technicalDetails": "The vulnerability is rooted in a failure to perform server-side authorization checks when processing user-supplied input for database operations. Specifically, the 'student_dashboard.php' script utilizes the 'roll_no' parameter directly within a 'mysqli_query' function call without verifying if the requesting user has the appropriate authorization to access data associated with that specific identifier.\nIn a typical deployment, the system is expected to retrieve student information based on the authenticated session's unique identifier. However, the current implementation blindly trusts the 'roll_no' parameter provided in the HTTP request. This parameter is used as a filter in the SQL query executed against the backend database.\nThe attack flow proceeds as follows: An attacker identifies that the application endpoint 'student_dashboard.php' accepts a 'roll_no' parameter to display student-specific data. By modifying the 'roll_no' value in the request (e.g., via URL parameter manipulation or intercepting the POST body), the attacker forces the application to query the database for records belonging to other students. Since the 'mysqli_query' function executes the query using the user-supplied value without additional authorization validation, the application returns the unauthorized records to the attacker's browser.\nThis is a classic broken object-level authorization (BOLA) or insecure direct object reference (IDOR) pattern. The lack of an established trust boundary at the application layer ensures that any value supplied to 'roll_no' is treated as legitimate, provided it conforms to the database schema's expected input format.\nThe impact is significant: an attacker can programmatically iterate through various 'roll_no' values to scrape the entire database, potentially accessing sensitive personal information, academic grades, and personal identifiers for all students registered in the system. The vulnerability is remotely exploitable over HTTP/HTTPS and does not require complex payloads, as the exploit relies on logical manipulation rather than traditional code injection vectors like SQL injection, although the result of unauthorized record retrieval is comparable in terms of data breach potential.\nGiven that the project uses a rolling release and has not yet addressed the issue, all instances running versions up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are currently exposed. Post-exploitation, an attacker gains complete visibility into the student management database's data segments accessible via this dashboard query."
}