Student Transcript System CVE-2026-9573

The /admin/modules/student/index.php?view=view endpoint must be network-reachable - if the admin panel is internet-exposed, exploitation requires no special conditions beyond HTTP access. The studentId parameter must be supplied in the request. Per CVSS PR:N (no privileges required), no authenticated session is needed as scored; however, because the endpoint resides under /admin/, defenders should verify whether a login page or session check precedes access in actual deployments - if authentication is enforced, exploitation is limited to users with valid admin credentials or those who have already compromised a session. No special platform configuration, non-default feature flags, or specific OS environment is required. Exploitation is limited in scope by the Low impact ratings: the attacker can read and modify data within the application's database context but cannot directly pivot to other systems (SC:N/SI:N/SA:N).

CVSS 4.0 scores this at 5.5 (Medium), with a network-facing, low-complexity, no-auth, no-interaction attack profile - the most permissive possible access conditions. However, all three impact dimensions (VC:L, VI:L, VA:L) are rated Low, with no subsequent system impact (SC:N/SI:N/SA:N), which suppresses the score and reflects limited blast radius rather than low exploitability. The E:P modifier (Proof of Concept) in the CVSS 4.0 vector aligns with the confirmed public POC on GitHub. SSVC signals amplify concern: the attack is rated Automatable:yes and Exploitation:poc, meaning scripted scanning and mass exploitation are feasible. Against these permissive signals, EPSS at 0.03% (9th percentile) suggests actual exploitation in the wild remains very limited - this may reflect that itsourcecode products are small-scale deployments with limited internet exposure rather than absence of attacker interest. A notable tension exists: the endpoint path contains /admin/, implying an administrative context that typically requires authentication, yet CVSS PR:N records no privilege requirement - defenders should verify whether authentication is enforced at the application layer before concluding this is truly unauthenticated.

A remote unauthenticated attacker - or one who has bypassed any admin login - sends a crafted HTTP request to /admin/modules/student/index.php?view=view with a malicious studentId value containing SQL metacharacters (e.g., a UNION SELECT or boolean-based blind payload). The unsanitized parameter is interpolated directly into a backend SQL query, allowing the attacker to enumerate database tables, extract student records including personally identifiable information, or potentially modify transcript data. A public POC demonstrating this technique exists on GitHub at https://github.com/nidieaaa/test/issues/12, lowering the skill barrier for exploitation.