| عنوان | SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 Improper Access Control |
|---|
| الوصف | A broken access control vulnerability exists in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The add_grade functionality in /index.php does not verify the user's role before processing the request. Any authenticated user, including those with the student role, can add or modify grades for any student in the system.
Affected File: /index.php
Affected Function: add_grade handler (line 190)
Affected Code:
if (isset($_POST['add_grade'])) {
$student_id = (int)$_POST['student_id'];
$subject_id = (int)$_POST['subject_id'];
$term = (int)$_POST['term'];
$score = (float)$_POST['score'];
$stmt = $pdo->prepare("INSERT INTO grades (student_id, subject_id, term, score) VALUES (?, ?, ?, ?)");
$stmt->execute([$student_id, $subject_id, $term, $score]);
}
Other state-changing actions (add_subject, add_user, edit_user, delete) correctly enforce $_SESSION['role'] === 'admin', but add_grade only checks isset($_SESSION['user_id']), allowing any authenticated user to execute it.
PoC Steps:
1. Login as a student-role user
2. Send POST request: POST /index.php?action=add_grade with body: add_grade=1&student_id=2&subject_id=1&term=12&score=100
3. Response contains "Grade successfully added"
4. Database confirms the grade was inserted for another student by a student-role user
Impact: A student can manipulate their own grades or sabotage other students' grades, compromising the academic integrity of the entire grading system. |
|---|
| المصدر | ⚠️ https://www.sourcecodester.com/php/18686/cet-automated-grading-system-ai-predictive-analytics-php-and-mysql.html |
|---|
| المستخدم | Yogender (UID 99560) |
|---|
| ارسال | 05/07/2026 11:48 AM (2 أشهر منذ) |
|---|
| الاعتدال | 20/08/2026 09:20 AM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 393622 [SourceCodester CET Automated Grading System with AI Predictive Analytics /index.php add_grade تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|