Studentinfo
Monthly
Authorization bypass in fuzui StudentInfo lets an authenticated remote attacker change another user's password by tampering with the sid/tid argument sent to the /StudentInfo/StudentHandler/moditypasswordstu endpoint, an insecure direct object reference (CWE-639) in the Password Change handler. The product ships as a rolling release, so no version boundary can be drawn and the affected set is effectively every deployment of the codebase up to commit fcc42a639ec7cef620651bfd0f07ebb660529e3f; the vendor was contacted early but never responded, and no public exploit code is identified at time of analysis. Scoring diverges sharply between sources: the vendor's CVSS 4.0 rating is 5.1 (medium) with all impacts rated Low and user interaction asserted, whereas our assessment rates the same issue as an unauthenticated-interaction, high confidentiality and integrity impact flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), so account-takeover risk should be treated as the governing concern rather than the vendor's medium score.
Authorization bypass in fuzui StudentInfo lets an authenticated remote attacker change another user's password by tampering with the sid/tid argument sent to the /StudentInfo/StudentHandler/moditypasswordstu endpoint, an insecure direct object reference (CWE-639) in the Password Change handler. The product ships as a rolling release, so no version boundary can be drawn and the affected set is effectively every deployment of the codebase up to commit fcc42a639ec7cef620651bfd0f07ebb660529e3f; the vendor was contacted early but never responded, and no public exploit code is identified at time of analysis. Scoring diverges sharply between sources: the vendor's CVSS 4.0 rating is 5.1 (medium) with all impacts rated Low and user interaction asserted, whereas our assessment rates the same issue as an unauthenticated-interaction, high confidentiality and integrity impact flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), so account-takeover risk should be treated as the governing concern rather than the vendor's medium score.