Student Management System CVE-2026-97646

Exploitation requires reaching the admin/fun/getStudent.php endpoint and supplying an attacker-chosen 'sid' argument to retrieve another subject's student record; the CVSS vector asserts no authentication or user interaction (PR:N/UI:N). Realistic limits: the endpoint sits under an admin/ directory, so exploitation presumes that path is network-reachable and not gated by an upstream login/session - if the deployment enforces admin authentication in front of this file, PR:N does not hold and the flaw reduces to an authenticated horizontal-access issue. Impact is confined to individual student records (Low across C/I/A).

Signals are consistent but point to LOW real-world priority. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack, yet all three impact metrics are only Low (VC:L/VI:L/VA:L), yielding a modest 6.9. The 'E:P' (Proof-of-Concept exploit maturity) sub-metric matches the stated public exploit - publicly available exploit code exists - but this is NOT active exploitation: there is no CISA KEV listing and no EPSS score in the input, so widespread automated abuse cannot be inferred. The dominant risk-limiting factor is the target itself: ningzichun/student-management-system is a small personal GitHub project with no meaningful production footprint, so even an unauthenticated IDOR has a tiny blast radius. Note a labeling tension worth verifying: the affected path is admin/fun/getStudent.php (an administrative endpoint), yet the vector asserts PR:N - verify whether the endpoint truly requires no session, since CWE-639 authorization bypass typically presumes an already-authenticated but under-privileged actor. Source is VulDB, a single low-signal reporter, and the vendor has not responded to the issue report, so no patch exists.

A remote attacker sends a crafted request to admin/fun/getStudent.php while manipulating the 'sid' parameter to reference a student record they are not authorized to view, and the endpoint returns that record without an ownership/authorization check. Publicly available exploit code (referenced in the project's GitHub issue #9) lowers the skill barrier, though the disclosed impact is limited (Low confidentiality/integrity/availability).