Cet Automated Grading System With Ai Predictive Analytics
Monthly
Improper authorization in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows authenticated remote attackers to perform unauthorized grade operations against arbitrary student records by manipulating the student_id parameter in the add_grade function at /index.php. This is a horizontal privilege escalation flaw - an authenticated user (e.g., a student) can affect records they do not own, compromising both confidentiality and integrity of academic grade data. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis, and the CVSS 4.0 score of 5.3 reflects medium severity with limited but real impact.
Session fixation in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 enables remote attackers to pre-set a known session identifier in a victim's browser, then hijack the authenticated session after the victim logs in. The CVSS 4.0 score of 2.9 reflects limited impact scope (low confidentiality, integrity, and availability) combined with high attack complexity, though a public exploit has been released (E:P). No CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis.
Improper access control in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 exposes the Student Self-Registration Endpoint (/index.php) to unauthenticated remote exploitation. The CWE-284 root cause, combined with the 'Authentication Bypass' tag, indicates that the self-registration flow fails to enforce intended access boundaries, potentially allowing unauthenticated users to access, manipulate, or enumerate data beyond their authorized scope. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Cross-site scripting in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via the unsanitized `action` parameter in `/index.php`. Publicly available exploit code exists (CVSS 4.0 E:P), and the attack requires no authentication, only that a victim interact with a crafted URL or request. No vendor-released patch has been identified at time of analysis.
Stored cross-site scripting in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows unauthenticated remote attackers to inject persistent malicious scripts via the student registration endpoint, which subsequently execute in the context of authenticated users - most critically, administrators - who view the submitted registration data. The exploit title in the public GitHub repository explicitly identifies the admin dashboard as the execution context, meaning a low-privilege registration action can target privileged session holders. No public exploitation confirmed in CISA KEV, but a proof-of-concept exploit is publicly available.
Improper authorization in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows authenticated remote attackers to perform unauthorized grade operations against arbitrary student records by manipulating the student_id parameter in the add_grade function at /index.php. This is a horizontal privilege escalation flaw - an authenticated user (e.g., a student) can affect records they do not own, compromising both confidentiality and integrity of academic grade data. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis, and the CVSS 4.0 score of 5.3 reflects medium severity with limited but real impact.
Session fixation in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 enables remote attackers to pre-set a known session identifier in a victim's browser, then hijack the authenticated session after the victim logs in. The CVSS 4.0 score of 2.9 reflects limited impact scope (low confidentiality, integrity, and availability) combined with high attack complexity, though a public exploit has been released (E:P). No CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis.
Improper access control in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 exposes the Student Self-Registration Endpoint (/index.php) to unauthenticated remote exploitation. The CWE-284 root cause, combined with the 'Authentication Bypass' tag, indicates that the self-registration flow fails to enforce intended access boundaries, potentially allowing unauthenticated users to access, manipulate, or enumerate data beyond their authorized scope. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Cross-site scripting in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via the unsanitized `action` parameter in `/index.php`. Publicly available exploit code exists (CVSS 4.0 E:P), and the attack requires no authentication, only that a victim interact with a crafted URL or request. No vendor-released patch has been identified at time of analysis.
Stored cross-site scripting in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows unauthenticated remote attackers to inject persistent malicious scripts via the student registration endpoint, which subsequently execute in the context of authenticated users - most critically, administrators - who view the submitted registration data. The exploit title in the public GitHub repository explicitly identifies the admin dashboard as the execution context, meaning a low-privilege registration action can target privileged session holders. No public exploitation confirmed in CISA KEV, but a proof-of-concept exploit is publicly available.