CVE-2026-76999 in CET Automated Grading System with AI Predictive Analytics
Summary
by MITRE • 08/20/2026
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /index.php. Performing a manipulation of the argument student_id results in improper authorization. The attack can be initiated remotely.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified within SourceCodester CET Automated Grading System version 1.0 represents a critical failure in access control mechanisms, specifically manifesting as an Insecure Direct Object Reference or Broken Access Control issue. This flaw is located within the add_grade function of the index.php file and allows for improper authorization when manipulating the student_id argument. The core technical deficiency lies in the application's inability to verify whether the authenticated user initiating the request has the legitimate administrative privileges required to modify grade records for arbitrary students. Instead of validating that the requesting entity owns or is authorized to manage the specific student record identified by the provided ID, the system blindly trusts this input parameter. This design oversight enables an attacker who possesses valid credentials for a lower-privilege account, such as a standard teacher or even a student if login access can be obtained, to escalate their privileges effectively within the context of grade management. By altering the student_id value in HTTP requests sent to the add_grade endpoint, an adversary can write data into records belonging to other users, thereby bypassing intended security boundaries that should restrict such actions to system administrators only.
From a technical perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, which are common in web applications that fail to perform adequate checks on user inputs before executing sensitive operations. The attack vector is classified as remote because the exploitation requires network access to the vulnerable application interface rather than local system interaction or physical proximity. An attacker can utilize standard HTTP clients or automated tools to craft malicious requests containing manipulated student_id parameters, effectively injecting unauthorized grade data into any student's profile within the database. This capability undermines the integrity of the academic record-keeping process and demonstrates a fundamental lack of server-side validation regarding user roles and resource ownership. The presence of AI Predictive Analytics in this system does not mitigate this specific flaw; rather, it highlights that even systems incorporating advanced features can suffer from basic security implementation errors if development practices do strictly enforce separation of duties and role-based access control principles.
The operational impact of this vulnerability is severe for educational institutions relying on the integrity of their grading data. Unauthorized modification of grades allows malicious actors to alter academic outcomes arbitrarily, which compromises trust in the assessment process and can lead to significant administrative complications including grade disputes, accreditation issues, and potential legal liabilities if fraudulent records are used for scholarships or admissions decisions. Furthermore, this flaw serves as a stepping stone for more sophisticated attacks; an attacker with write access to student data might attempt further exploitation such as SQL injection by injecting malicious payloads into the grade fields, potentially leading to full database compromise or remote code execution depending on how the backend processes these inputs. The ability to manipulate records remotely also facilitates persistent threats where attackers can continuously adjust grades over time without detection if logging and monitoring mechanisms are insufficiently configured to flag anomalous write operations from non-administrative accounts.
Mitigation strategies must focus on implementing robust access control checks at the application layer immediately upon receipt of any request targeting sensitive resources like grade records. Developers should enforce strict role-based access control by verifying that the authenticated user possesses administrative privileges before allowing execution of the add_grade function, regardless of the student_id provided in the payload. Additionally, indirect reference maps or opaque identifiers should be used instead of exposing direct database primary keys to prevent enumeration and manipulation attempts. Input validation must also be strengthened to ensure that only expected data types are processed, although this alone is insufficient without proper authorization checks. Security testing procedures such as penetration testing focused on broken access control scenarios and static application security testing reviews can help identify similar flaws in other parts of the system. Adhering to OWASP Top 10 guidelines regarding authentication and authorization failures will significantly reduce the risk profile associated with this vulnerability, ensuring that only authorized personnel can modify critical academic data within the CET Automated Grading System environment.