Description

A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T06:17:08.280Z",
  "pubdate": "2026-08-31T06:17:08.280Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in Soarkey StudentManagement and 学生信息管理系统 up to version e08f7f1d5015af407aa4cca0ada3dea189b4937e.\nThe vulnerability resides in the Administrative Servlet's AdminDao.doGet function, specifically within the handling of the 'action' parameter.\nThis flaw permits unauthenticated remote attackers to circumvent established access control mechanisms, potentially granting unauthorized access to administrative functions.\nThe vulnerability has been publicly disclosed with active exploits available, posing a significant risk to the confidentiality and integrity of student information managed by the system.\nDespite early notification to the project maintainers, the vulnerability remains unpatched, necessitating immediate manual intervention by system administrators to prevent exploitation.",
  "technicalDetails": "The vulnerability is localized within the AdminDao.doGet method, located in code/src/service/AdminDao.java. The root cause lies in an insecure implementation of access control checks during the processing of HTTP GET requests handled by the Administrative Servlet.\nSpecifically, the application logic fails to properly validate the session or authorization state of the requester before executing sensitive actions triggered by the 'action' parameter. Because the function processes the 'action' argument without verifying if the requesting user possesses the requisite administrative privileges, it allows an attacker to manipulate the request to invoke unauthorized administrative routines.\nThe attack flow begins with an attacker identifying the endpoint associated with the Administrative Servlet. By crafting a HTTP GET request and supplying a specific 'action' parameter value, the attacker bypasses the internal authorization gatekeeper logic that is intended to restrict access to authenticated administrators only. Since the check is performed improperly or omitted within the doGet implementation, the application proceeds to execute the code mapped to the supplied action value.\nThis vulnerability is reachable remotely over the network without requiring prior authentication, significantly lowering the barrier for exploitation. The lack of robust server-side validation for the 'action' parameter essentially treats the request as trusted. Post-exploitation impact includes unauthorized data retrieval, modification of student records, or the execution of administrative functions which could lead to a complete compromise of the application's data layer.\nThe issue is present in all versions up to the commit hash e08f7f1d5015af407aa4cca0ada3dea189b4937e. As public exploit code is already circulating, systems using this version are at immediate risk of being targeted by automated scanners or manual exploitation attempts. The failure of the application to implement a centralized, secure authentication filter for all servlet endpoints has allowed this critical flaw to persist."
}