EUVD-2026-31722
GHSA-vrf4-h9f2-qjfw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected by this vulnerability is the function getClassroomStudents/removeStudentFromClassroom of the file classroom.php. Executing a manipulation of the argument classroom_id can lead to improper authorization. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
AnalysisAI
Improper authorization in SourceCodester Student Grades Management System 1.0 allows authenticated remote attackers to manipulate the classroom_id parameter within classroom.php to access or modify classroom enrollment data beyond their authorized scope. The vulnerability affects the getClassroomStudents and removeStudentFromClassroom functions, enabling unauthorized listing of enrolled students or removal of students from classrooms the attacker does not administer. A publicly available proof-of-concept exploit exists on GitHub, though EPSS places exploitation probability at just 0.04% (13th percentile), and the vulnerability is not currently listed in the CISA KEV catalog.
Technical ContextAI
The affected application is a PHP-based educational management system developed by SourceCodester, identified via CPE cpe:2.3:a:sourcecodester:student_grades_management_system:*:*:*:*:*:*:*:*. The root cause is CWE-285 (Improper Authorization), meaning the server-side logic in classroom.php fails to verify that the authenticated user is actually authorized to operate on the classroom_id value supplied in the request. Both the getClassroomStudents and removeStudentFromClassroom functions accept a user-controlled classroom_id without enforcing object-level authorization - a class of vulnerability also known as Insecure Direct Object Reference (IDOR). This is a well-understood PHP application security failure where session/authentication checks are present but authorization enforcement against specific resource ownership is absent.
RemediationAI
No vendor-released patch has been identified at time of analysis; the SourceCodester project has not published a security advisory or fixed release. Administrators running Student Grades Management System 1.0 should implement server-side authorization checks within classroom.php to verify that the authenticated user's session is associated with the requested classroom_id before executing getClassroomStudents or removeStudentFromClassroom - this is the primary architectural fix. As a compensating control, restrict access to classroom.php endpoints to specific authenticated roles (e.g., only instructors assigned to a classroom), enforced at the application or web server level via access control lists. Additionally, consider disabling the removeStudentFromClassroom function entirely for student-level roles until a proper fix is implemented, accepting the trade-off that bulk enrollment management may require administrative intervention. Monitor application logs for anomalous classroom_id enumeration patterns. Reference the public POC at https://github.com/Jack-MRJ/Student-Grades-Management-System-Vulnerability-Report to understand the exact request structure being exploited.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today