CVE-2026-10168: School Student Management System RCE Flaw

CVE-2026-10168 Overview

CVE-2026-10168 affects the OUSL-GROUP-BrinaryBrains School Student Management System through commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6. The flaw resides in the marks function within application/controllers/Parents.php. Attackers can manipulate the param1 argument to trigger improper control of resource identifiers [CWE-99]. The vulnerability is remotely exploitable and has been publicly disclosed. The project follows a continuous delivery model with rolling releases, so no specific affected or fixed version numbers are published. The maintainers were notified via an issue report but have not yet responded.

Critical Impact
Authenticated remote attackers can manipulate resource identifier parameters to access or affect resources outside their intended scope within the application.

Affected Products

OUSL-GROUP-BrinaryBrains School Student Management System (rolling release)
Affected commit: 1e70e5ad1125b86dca4ee086eb6bb121f17708b6
File: application/controllers/Parents.php, function marks

Discovery Timeline

2026-05-31 - CVE CVE-2026-10168 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10168

Vulnerability Analysis

The vulnerability is classified under [CWE-99] Improper Control of Resource Identifiers, commonly referred to as Resource Injection. The marks function in application/controllers/Parents.php accepts a user-controlled param1 argument and uses it without adequate validation to reference an internal resource. Because the application does not enforce strict mapping between user input and authorized resources, an authenticated attacker can substitute arbitrary identifiers to interact with resources outside the scope intended for that user. Public disclosure of the exploit details increases the likelihood of opportunistic abuse against exposed instances.

Root Cause

The root cause is missing validation and authorization checks on the param1 argument before it is used to look up or operate on an internal resource. The controller trusts client-supplied identifier values and does not verify that the requesting user is entitled to the referenced object. This is a common pattern in PHP MVC applications where controller actions accept identifiers directly from request parameters and pass them to model or data-access layers without an ownership check.

Attack Vector

The attack is initiated remotely over the network and requires low privileges, consistent with a parent-role account in the application. An attacker submits a crafted request to the marks endpoint and substitutes the param1 value to point at unintended resources. The vulnerability mechanism is described in the GitHub Issue Discussion and the VulDB Vulnerability Details. No verified proof-of-concept code is published in the enriched dataset, so technical details should be reviewed through the linked references.

Detection Methods for CVE-2026-10168

Indicators of Compromise

Unexpected HTTP requests to the Parents/marks controller endpoint containing unusual or sequentially enumerated param1 values.
Authenticated sessions accessing marks records that do not correspond to any child linked to the parent account.
Repeated 200-OK responses to the marks endpoint from a single session with varying param1 identifiers, indicating enumeration.

Detection Strategies

Implement server-side logging of the param1 argument and correlate it with the authenticated user's authorized resource set.
Use a web application firewall rule to flag requests where the param1 value falls outside a known whitelist for the active session.
Review application logs for high-frequency access patterns against the Parents.php controller.

Monitoring Recommendations

Centralize web server and PHP application logs to an analytics platform to baseline normal access patterns for the marks function.
Alert on anomalous identifier distributions in param1 per authenticated user.
Monitor the upstream repository's GitHub Issue Discussion for a project response or patch commit.

How to Mitigate CVE-2026-10168

Immediate Actions Required

Restrict network exposure of the application to trusted users only until a fix is available.
Add server-side authorization checks ensuring that any param1 value supplied to the marks function maps to a resource the authenticated parent is permitted to view.
Validate param1 against an expected type and an allow-list derived from the user's session context.

Patch Information

No official patch is available. The project uses continuous delivery with rolling releases, and the maintainers have not yet responded to the disclosure. Operators should track the VulDB Vulnerability Details page and the upstream repository for any forthcoming commit that addresses the marks function in application/controllers/Parents.php.

Workarounds

Apply a reverse-proxy rule that rejects requests to /Parents/marks where param1 does not match an expected numeric format.
Implement an application-layer middleware to enforce that the param1 resource identifier belongs to the authenticated parent account.
Disable the parent portal feature in production until a vetted fix is merged upstream.

bash

# Example NGINX rule to constrain param1 to numeric values and limit request rate
location /index.php {
    if ($arg_param1 !~ "^[0-9]+$") {
        return 400;
    }
    limit_req zone=parents_marks burst=5 nodelay;
    include fastcgi_params;
    fastcgi_pass php_upstream;
}