Authorization Bypass in Soarkey StudentManagement

Executive Summary

This vulnerability is an authorization bypass in Soarkey StudentManagement and 学生信息管理系统. It allows remote attackers to perform administrative functions without authentication by manipulating the 'action' parameter in the AdminDao.doGet function. The servlet does not validate user permissions or session status, enabling unauthorized access to sensitive data and operations.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthenticated access to the /AdminDao servlet endpoint by sending HTTP GET requests with manipulated 'action' parameters. Look for responses containing sensitive data like user credentials or administrative functions without session validation.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive data like user credentials, create or delete departments, and modify application data without authorization. This could lead to data breaches, loss of data integrity, and unauthorized administrative control over the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without authorization and HIPAA by compromising protected health information. It undermines data confidentiality and integrity requirements, potentially leading to legal penalties and loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or restrict access to the /AdminDao servlet endpoint. Implement session validation and authentication checks before processing administrative actions. Update the application to enforce proper authorization controls.

Useful 0 Not Useful 0