| शीर्षक | SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 Improper Access Control |
|---|
| विवरण | A broken access control vulnerability exists in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The add_grade functionality in /index.php does not verify the user's role before processing the request. Any authenticated user, including those with the student role, can add or modify grades for any student in the system.
Affected File: /index.php
Affected Function: add_grade handler (line 190)
Affected Code:
if (isset($_POST['add_grade'])) {
$student_id = (int)$_POST['student_id'];
$subject_id = (int)$_POST['subject_id'];
$term = (int)$_POST['term'];
$score = (float)$_POST['score'];
$stmt = $pdo->prepare("INSERT INTO grades (student_id, subject_id, term, score) VALUES (?, ?, ?, ?)");
$stmt->execute([$student_id, $subject_id, $term, $score]);
}
Other state-changing actions (add_subject, add_user, edit_user, delete) correctly enforce $_SESSION['role'] === 'admin', but add_grade only checks isset($_SESSION['user_id']), allowing any authenticated user to execute it.
PoC Steps:
1. Login as a student-role user
2. Send POST request: POST /index.php?action=add_grade with body: add_grade=1&student_id=2&subject_id=1&term=12&score=100
3. Response contains "Grade successfully added"
4. Database confirms the grade was inserted for another student by a student-role user
Impact: A student can manipulate their own grades or sabotage other students' grades, compromising the academic integrity of the entire grading system. |
|---|
| स्रोत | ⚠️ https://www.sourcecodester.com/php/18686/cet-automated-grading-system-ai-predictive-analytics-php-and-mysql.html |
|---|
| उपयोगकर्ता | Yogender (UID 99560) |
|---|
| सबमिशन | 05/07/2026 11:48 AM (2 महीनों पहले) |
|---|
| संयम | 20/08/2026 09:20 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 393622 [SourceCodester CET Automated Grading System with AI Predictive Analytics /index.php add_grade अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|