Privilege Escalation in Soarkey StudentManagement

Executive Summary

This vulnerability is an improper privilege management flaw in Soarkey StudentManagement. It allows unauthenticated users to register as administrators by manipulating the privilege level parameter during registration. The application fails to validate or restrict user-supplied role assignments, enabling attackers to set their account role to administrator without server-side checks.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized administrator accounts by reviewing user roles in the database. Inspect HTTP POST requests to /register.html or RegisterServlet.doPost for the level parameter set to '管理员'. Monitor for unexpected admin interface access logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this to create an administrator account and gain full control over the system. This includes unauthorized access to manage user data, departments, classes, students, courses, and grades. The impact is severe as it allows complete system compromise without authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR requires strict access controls and protection of personal data, while HIPAA mandates secure handling of sensitive health information. Unauthorized admin access could lead to data breaches, non-compliance penalties, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Disable public registration if not required. Implement server-side validation to restrict role assignment to non-privileged levels. Add CAPTCHA or email verification to registration. Review and remove any unauthorized admin accounts already created.

Useful 0 Not Useful 0