CVE-2026-97647
Received Received - Intake

Authorization Bypass in Ningzichun Student-Management-System

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulDB

Description
A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97647
EUVD
EUVD-2026-86495

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ningzichun student-management-system to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the ningzichun student-management-system affecting the user/editLog.php file. It allows unauthenticated users to manipulate student reward and disciplinary records by sending crafted POST requests with parameters like sid, addtime, type, reason, detail, and logdate. The system fails to verify user permissions, enabling attackers to forge or alter records without an account.

Detection Guidance

Check for unauthorized POST requests to user/editLog.php with manipulated parameters like sid, addtime, type, reason, detail, or logdate. Monitor for unexpected changes in student reward or disciplinary records. Review server logs for suspicious activity targeting this file.

Impact Analysis

An attacker could exploit this to modify sensitive student records, such as disciplinary history or rewards, without authorization. This could lead to incorrect data in the system, reputational damage, or misuse of student information. The attack can be performed remotely without requiring an account.

Compliance Impact

This vulnerability could violate data integrity and access control requirements under GDPR and HIPAA. Unauthorized modifications to student records may result in non-compliance with privacy and security regulations, potentially leading to legal consequences or fines for failing to protect sensitive personal data.

Mitigation Strategies

Immediately restrict access to user/editLog.php by implementing session checks, ownership validation, or role-based access control. Sanitize all user input in POST requests to prevent SQL injection. Update the system to enforce proper authorization before processing record modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97647. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart