CVE-2026-97646: Student Management System Auth Bypass Flaw

CVE-2026-97646 Overview

CVE-2026-97646 is an authorization bypass vulnerability in the ningzichun student-management-system project, affecting commits up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. The flaw resides in the admin/fun/getStudent.php endpoint, where manipulation of the sid parameter allows attackers to bypass access controls. The weakness is tracked under CWE-285: Improper Authorization. Remote exploitation is possible without authentication, and a public exploit has been disclosed. According to the VulDB entry for CVE-2026-97646, the project maintainers were notified through a public issue report but have not responded.

Critical Impact

Remote attackers can bypass authorization checks on the getStudent.php endpoint by manipulating the sid argument, potentially exposing student records to unauthenticated users.

Affected Products

• ningzichun student-management-system (GitHub project)
• All revisions up to and including commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf
• Deployments exposing admin/fun/getStudent.php to untrusted networks

Discovery Timeline

• 2026-09-25 - CVE-2026-97646 published to NVD
• 2026-09-25 - Last updated in NVD database
• Reference - Issue tracked in the GitHub Issue #9 Discussion

Technical Details for CVE-2026-97646

Vulnerability Analysis

The vulnerability stems from improper authorization enforcement in the admin/fun/getStudent.php script. The endpoint accepts the sid (student identifier) parameter and returns student information without verifying that the requesting session has the required administrative role. An attacker can therefore invoke the handler directly and retrieve records that should be gated behind authenticated admin access.

Because the project is an open-source PHP application typically deployed in classroom or small-institution contexts, exposed instances may be reachable over the public internet or shared campus networks. The attack requires no user interaction and no prior credentials. The flaw maps to CWE-285: Improper Authorization, reflecting missing access control on a sensitive data-retrieval function.

Root Cause

The root cause is the absence of a server-side session or role check inside getStudent.php before processing the sid argument. The script trusts the caller and queries the backing data store based solely on client-supplied input. Authorization logic that should restrict the endpoint to authenticated administrators is either missing or trivially bypassed.

Attack Vector

Exploitation is performed remotely over the network by issuing an HTTP request to admin/fun/getStudent.php with a chosen sid value. Because the endpoint does not validate authorization, the response discloses student data belonging to the referenced identifier. A public exploit is referenced in the VulDB disclosure, lowering the barrier to opportunistic abuse.

No verified exploit code is reproduced here. For technical details, refer to the VulDB Vulnerability #409748 entry and the upstream GitHub Student Management System repository.

Detection Methods for CVE-2026-97646

Indicators of Compromise

• Unauthenticated HTTP GET or POST requests to admin/fun/getStudent.php originating from external or unexpected IP addresses.
• Repeated requests iterating sequential or enumerated sid values, indicative of record scraping.
• Access to administrative paths without a preceding successful login event in web server logs.

Detection Strategies

• Review web server access logs for requests to /admin/fun/getStudent.php that lack a valid session cookie or authenticated referrer.
• Deploy web application firewall (WAF) rules that require an authenticated session cookie for all /admin/ paths and alert on violations.
• Correlate request bursts against the getStudent.php endpoint with absence of prior /admin/login events in the same session.

Monitoring Recommendations

• Enable verbose HTTP access and application logging on the PHP host and forward records to a centralized analytics platform.
• Baseline normal administrative traffic patterns and alert on anomalies such as off-hours access or non-admin source IPs.
• Monitor outbound data volume from the application server for signs of bulk record exfiltration.

How to Mitigate CVE-2026-97646

Immediate Actions Required

• Restrict network access to /admin/ paths using firewall rules, reverse proxy ACLs, or HTTP basic authentication at the web server layer.
• Take vulnerable deployments offline if they are exposed to the public internet until an upstream fix is available.
• Audit application and database logs for prior unauthorized access to student records.

Patch Information

As of the NVD publication date (2026-09-25), the upstream project has not released a patch. The maintainers were notified through GitHub Issue #9 Discussion but have not responded. Operators should monitor the GitHub Student Management System repository for future commits that add authorization checks to admin/fun/getStudent.php.

Workarounds

• Add a server-side session validation check at the top of admin/fun/getStudent.php that rejects requests lacking an authenticated administrator session.
• Place the entire /admin/ directory behind a reverse proxy that enforces authentication (for example, an OAuth2 proxy or basic auth gateway).
• Apply WAF signatures to block unauthenticated requests to administrative endpoints and rate-limit requests enumerating the sid parameter.
• Consider migrating to a maintained student information system if the upstream project remains unresponsive.

# Example nginx snippet to require authentication on /admin/
location /admin/ {
    auth_basic "Restricted Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    allow 10.0.0.0/8;
    deny all;
    try_files $uri $uri/ /index.php?$query_string;
}