Student Management System CVE-2026-11532

Exploitation requires the attacker to possess a valid low-privilege account on the Student Management System (CVSS PR:L confirmed). The application must be network-accessible (AV:N). The /add.php Student Record Handler must be reachable by the authenticated session - if this endpoint is restricted at the server level to admin roles only, exploitation is blocked. No user interaction from a victim is required (UI:N), and no special attack prerequisites beyond authentication exist (AT:N, AC:L). Limiting factors include: the requirement for at least low-privilege authentication prevents fully unauthenticated attacks; impact is bounded to the vulnerable component only with no lateral scope (SC:N/SI:N/SA:N); and the application is a niche open-source academic tool, constraining the exposed population to institutions that have self-hosted it.

The CVSS 4.0 base score of 2.1 is low, driven by PR:L (low privileges required), and all impact metrics rated Low with no downstream system scope. The CVSS vector AV:N/AC:L/AT:N confirms network reachability with low complexity and no attack preconditions beyond obtaining low-level credentials. The Exploit Maturity modifier E:P confirms a proof-of-concept exists, which elevates urgency slightly above pure theoretical risk. There is no CISA KEV listing, indicating no confirmed widespread active exploitation. EPSS data is not provided. The real-world risk is LOW for organizations not running this specific application, and MODERATE for institutions (schools, universities) that have deployed this open-source PHP system and expose it to the internet - particularly if student-level accounts are widely distributed. The 'Authentication Bypass' tag introduces some ambiguity: the CVSS PR:L vector confirms authentication is required, but the tag may indicate that the authenticated session can be leveraged to bypass role-level controls, which is a more meaningful threat in multi-role academic environments. No conflicting signals between CVSS and description were identified.

An attacker with a low-privileged account (e.g., a student user account in the system) sends a crafted HTTP request directly to /add.php, bypassing the role-based access checks that should restrict record creation or modification to administrative users. Because the server-side authorization logic is insufficient (CWE-284), the request is processed and the attacker successfully adds or manipulates student records. A public proof-of-concept is available via the GitHub issue at https://github.com/imvks786/student_management_system/issues/3, lowering the skill threshold for exploitation.