Studentmanagement
Monthly
Privilege escalation in Soarkey StudentManagement allows unauthenticated remote attackers to self-assign arbitrary privilege levels during account registration by manipulating the `level` POST parameter in the Registration Workflow handled by `RegisterServlet.doPost`. An attacker can register a standard user account but set their privilege level to administrator, gaining unauthorized access to elevated functionality such as student record management. A publicly available proof-of-concept exists via GitHub issue #35, and SSVC classifies this as automatable with partial technical impact.
Authorization bypass in Soarkey StudentManagement (学生信息管理系统) exposes administrative functions to unauthenticated remote attackers by allowing manipulation of the `action` parameter in the Administrative Servlet's `AdminDao.doGet()` handler. The CVSS 4.0 vector confirms PR:N - no credentials required - and a public proof-of-concept exploit exists via GitHub issue #32. The project maintainer was notified but has not responded, leaving the vulnerability unpatched across all known versions through commit e08f7f1d.
SQL injection in Soarkey StudentManagement (学生信息管理系统) allows authenticated remote attackers to read from or manipulate the backing database by supplying malicious input to the `cno` parameter of the `CourseDao.course_ranking()` method. All versions up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e are affected with no vendor patch available, as the project maintainer has not responded to the disclosure. Publicly available exploit code exists via GitHub issue #33, though no CISA KEV listing is present.
Privilege escalation in Soarkey StudentManagement allows unauthenticated remote attackers to self-assign arbitrary privilege levels during account registration by manipulating the `level` POST parameter in the Registration Workflow handled by `RegisterServlet.doPost`. An attacker can register a standard user account but set their privilege level to administrator, gaining unauthorized access to elevated functionality such as student record management. A publicly available proof-of-concept exists via GitHub issue #35, and SSVC classifies this as automatable with partial technical impact.
Authorization bypass in Soarkey StudentManagement (学生信息管理系统) exposes administrative functions to unauthenticated remote attackers by allowing manipulation of the `action` parameter in the Administrative Servlet's `AdminDao.doGet()` handler. The CVSS 4.0 vector confirms PR:N - no credentials required - and a public proof-of-concept exploit exists via GitHub issue #32. The project maintainer was notified but has not responded, leaving the vulnerability unpatched across all known versions through commit e08f7f1d.
SQL injection in Soarkey StudentManagement (学生信息管理系统) allows authenticated remote attackers to read from or manipulate the backing database by supplying malicious input to the `cno` parameter of the `CourseDao.course_ranking()` method. All versions up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e are affected with no vendor patch available, as the project maintainer has not responded to the disclosure. Publicly available exploit code exists via GitHub issue #33, though no CISA KEV listing is present.