Student Management System CVE-2026-97648

Exploitation requires an authenticated victim (administrator or user) with an active session in the student-management-system to be socially engineered into visiting an attacker-controlled page or clicking a crafted link while logged in (UI:P/UI:R). The attack works against a state-changing endpoint that lacks anti-CSRF token validation; the specific endpoint is not identified in the advisory ('unknown function'). Limiting factors: the attacker cannot read responses (no confidentiality impact) and the effect is a single limited integrity change per tricked victim; exploitation fails if the victim is not logged in, if the application enforces CSRF tokens/SameSite cookies, or if same-site protections in modern browsers block the forged request. No attacker authentication is needed. Affected: ningzichun/student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf, with no fixed version available.

This is a classic high-noise, low-priority signal. The only quantitative signal is a VulDB-assigned CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) with exploit maturity E:P (proof-of-concept), which is consistent with CWE-352 CSRF: network-reachable, low complexity, no attacker privileges, but requiring victim interaction (UI:P) and yielding only limited integrity impact (VI:L) with no confidentiality or availability impact. Publicly available exploit code exists (referenced GitHub issue #12), which raises the practical bar only marginally because CSRF PoCs are trivial. There is NO EPSS score, NO CISA KEV listing, and no evidence of active exploitation in the provided data - so this is publicly available exploit code exists, not confirmed active exploitation; do not conflate the two. Net: the product is an obscure GitHub hobby/student project with negligible enterprise footprint, the impact is limited (single low-integrity state change per tricked victim, no confidentiality/availability loss), and exploitation requires a logged-in victim to interact with attacker content. This is a low-real-risk issue whose modest CVSS is driven by the network vector rather than by meaningful impact; it should not be prioritized over KEV/EPSS-elevated findings. Note the source: VulDB is a low-signal, high-volume reporter and the affected function is described only as 'an unknown function,' so the specific vulnerable endpoint is unconfirmed.

An attacker hosts a malicious page (or sends a link/email) containing a hidden auto-submitting form or crafted request targeting a state-changing endpoint of the student-management-system. When an already-authenticated administrator or user visits the page, their browser silently submits the forged request under their session, performing an unwanted action (e.g., creating/modifying a record). A public proof-of-concept exists via the project's GitHub issue tracker, making this trivial to reproduce.