ningzichun student-management-system Multiple Flaws

Authorization bypass in ningzichun student-management-system (versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf) allows remote attackers to read other students' records by manipulating the 'sid' parameter of admin/fun/getStudent.php. Publicly available exploit code exists, and the maintainer has not responded to the report, so no vendor-released patch is identified. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, limiting impact to confidentiality of individual records, but the PR:N rating assumes the admin/ path is reachable without upstream authentication.

Authorization bypass in ningzichun's student-management-system (all versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf) allows a remote attacker to tamper with log records by manipulating the sid, addtime, type, reason, detail and logdate arguments passed to user/editLog.php, circumventing the intended ownership/authorization check on those records. Publicly available exploit code exists and the flaw was disclosed through a public GitHub issue report that the maintainer has not responded to, so exposed deployments should be considered at risk. The impact is integrity-only log tampering with no confidentiality or availability loss, and because the affected code is a rare, unmaintained hobby project with no patched release, the realistic risk is low despite a moderate 6.9 CVSS 4.0 base score; authentication requirements are not firmly confirmed from available data, as VulDB rates the vector PR:N while independent analysis assesses PR:L.

Reflected cross-site scripting in ningzichun student-management-system allows unauthenticated remote attackers to inject arbitrary script into the admin/fun/addLog.php log entry function via the reason or detail parameters; exploitation requires a victim to interact with a crafted link, and publicly available exploit code exists. The flaw is rated CVSS 4.0 5.3 (Medium) with no privileges required but user interaction, and independent assessment confirms it is limited to integrity impact with no direct confidentiality or availability loss. The project maintainer has not responded to the reported issue, and no vendor patch is identified at time of analysis.

Cross-site request forgery in ningzichun's student-management-system (up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf) lets an unauthenticated attacker forge state-changing requests that execute in the browser of a logged-in administrator or user, producing a limited integrity-only modification. Exploitation requires the victim to hold an active session and be socially engineered into visiting an attacker-controlled page or clicking a crafted link (UI:P/UI:R); confidentiality and availability are unaffected. Publicly available exploit code exists and the CVE carries an EPSS-relevant proof-of-concept flag, though there is no confirmed active exploitation (CISA KEV), and the upstream project was notified via an issue report but has not responded and has released no fix.

Default-credential exposure in ningzichun's student-management-system allows remote attackers to authenticate with the administrator password shipped in the example_lite.sql seed file, obtaining full access to the application's administrative functionality and stored data. The flaw affects all versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf, and publicly available exploit code exists, though no CISA KEV listing or other confirmation of active exploitation is present. Exploitation is entirely gated on the operator having initialized the database from example_lite.sql and never rotated the seeded account password; given that this is an obscure, rarely deployed hobby project, overall real-world risk is low despite the moderate 5.1 CVSS 4.0 score.