CVE-2026-97648
Received Received - Intake

Cross-Site Request Forgery in ningzichun student-management-system

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulDB

Description
A vulnerability was detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function. Performing a manipulation results in cross-site request forgery. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97648
EUVD
EUVD-2026-86496

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ningzichun student-management-system to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in the ningzichun student-management-system. It affects the course withdrawal feature where a GET request to user/delCourse.php deletes a student's pending course selection without proper validation. The system relies only on session cookies, lacking CSRF tokens, Origin or Referer checks, or user confirmation.

Detection Guidance

To detect this CSRF vulnerability, inspect the user/delCourse.php file in the student-management-system for GET requests performing destructive actions like database deletions without CSRF tokens, Origin/Referer checks, or user confirmation. Check if the endpoint relies solely on session cookies for authentication.

Impact Analysis

An attacker could trick an authenticated student into visiting a malicious page, which would trigger an unauthorized course withdrawal. This could disrupt the student's study plan and compromise enrollment integrity by removing courses without their consent.

Compliance Impact

This vulnerability, a Cross-Site Request Forgery (CSRF) flaw, could potentially impact compliance with data protection regulations like GDPR and HIPAA by enabling unauthorized modifications to student data without consent. For GDPR, this may affect integrity and consent requirements, while for HIPAA, it could compromise protected health information integrity if course data relates to medical or health-related courses.

Mitigation Strategies

Immediately update the student-management-system to a patched version or modify user/delCourse.php to require CSRF tokens, validate Origin/Referer headers, and implement user confirmation before destructive actions. Ensure all sensitive endpoints enforce POST requests instead of GET.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97648. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart