CVE-2026-97646
Received Received - Intake

Authorization Bypass in Ningzichun Student-Management-System

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulDB

Description
A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the file admin/fun/getStudent.php. This manipulation of the argument sid causes authorization bypass. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97646
EUVD
EUVD-2026-86488

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ningzichun student-management-system 98760f5711cf6dc8b4adca53a9e207ca49b02ebf

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the ningzichun student-management-system. It allows remote attackers to gain unauthorized access to administrative functions by manipulating the 'sid' argument in the file admin/fun/getStudent.php. The flaw exists because certain admin handlers under /admin/fun/ do not validate administrator sessions, enabling attackers to access sensitive student data, reset passwords, and modify academic records without authentication.

Detection Guidance

Check for unauthorized access to admin endpoints like /admin/fun/getStudent.php by monitoring HTTP requests to these paths. Look for requests without valid session cookies or unusual sid parameter values. Inspect server logs for repeated failed login attempts or unexpected administrative actions.

Impact Analysis

If you are using the affected student-management-system, attackers could remotely access student records, reset passwords to take over accounts, manipulate grades or course enrollments, and delete administrative data. This could lead to privacy breaches, academic fraud, or disruption of system operations. The exploit is publicly available, increasing the risk of attacks.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by exposing sensitive student data without proper access controls. GDPR requires strict protection of personal data, while HIPAA mandates safeguards for protected health information. The unauthorized access and potential data leaks could result in legal penalties, fines, and reputational damage for organizations using the affected system.

Mitigation Strategies

Immediately restrict access to the /admin/fun/ directory by updating firewall rules or web server configurations. Remove or disable the vulnerable endpoints if possible. Implement session validation for all administrative handlers and update the system to the latest version if a patch is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97646. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart