Description

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper privilege management. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-14T14:17:19.530Z",
  "pubdate": "2026-09-14T14:17:19.530Z",
  "executiveSummary": "A critical vulnerability exists in the Soarkey StudentManagement system, specifically within the Registration Workflow component. The vulnerability is classified as improper privilege management, stemming from insecure handling of user-supplied input during the registration process.\nThis flaw allows remote, unauthenticated attackers to elevate their privileges by manipulating the 'level' argument within the RegisterServlet.doPost function. Successful exploitation grants attackers unauthorized access to elevated administrative or restricted system functions.\nThe vulnerability affects Soarkey StudentManagement up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e. Given the public availability of an exploit, the risk of active exploitation is significant.\nThe vendor has not provided a patch or addressed the reported issue, leaving deployments exposed to unauthorized privilege escalation and subsequent system compromise.",
  "technicalDetails": "The vulnerability resides in the RegisterServlet.doPost function located in code/WebContent/register.html, which handles user registration requests. The core issue is an insecure implementation of access control where the server-side code trusts and processes the 'level' parameter provided by the client during the HTTP POST request without performing adequate server-side validation or authorization checks.\nIn a typical secure registration workflow, privilege levels should be hardcoded or assigned by an internal business logic layer based on the user's role or registration context. In the vulnerable Soarkey implementation, the application accepts the 'level' parameter from the incoming POST body and maps this value directly to the user's account permissions in the backend database or session state.\nThe attack flow proceeds as follows: 1. An attacker initiates a registration request to the endpoint associated with RegisterServlet.doPost. 2. During the request formulation, the attacker includes the 'level' parameter in the HTTP payload, setting it to a value that corresponds to a privileged role (e.g., administrator). 3. The server-side application processes the request, parses the malicious 'level' input, and persists this elevated privilege level to the user account created during the registration process. 4. The attacker authenticates with the newly created account and assumes the elevated permissions assigned via the manipulation.\nThis vulnerability is remotely exploitable and does not require pre-existing authentication, as the registration interface is typically public-facing. The impact is a complete bypass of the intended authorization schema, allowing for unauthorized access to administrative functions, sensitive student data, and potential full system compromise depending on the level of privilege acquired.\nSince the product lacks formal versioning, all installations using the affected codebase up to the identifier e08f7f1d5015af407aa4cca0ada3dea189b4937e are susceptible. The lack of server-side input sanitization and enforcement of role-based access control (RBAC) at the service level represents a failure in the application's security architecture."
}