| タイトル | SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 Improper Access Control |
|---|
| 説明 | A broken access control vulnerability exists in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The add_grade functionality in /index.php does not verify the user's role before processing the request. Any authenticated user, including those with the student role, can add or modify grades for any student in the system.
Affected File: /index.php
Affected Function: add_grade handler (line 190)
Affected Code:
if (isset($_POST['add_grade'])) {
$student_id = (int)$_POST['student_id'];
$subject_id = (int)$_POST['subject_id'];
$term = (int)$_POST['term'];
$score = (float)$_POST['score'];
$stmt = $pdo->prepare("INSERT INTO grades (student_id, subject_id, term, score) VALUES (?, ?, ?, ?)");
$stmt->execute([$student_id, $subject_id, $term, $score]);
}
Other state-changing actions (add_subject, add_user, edit_user, delete) correctly enforce $_SESSION['role'] === 'admin', but add_grade only checks isset($_SESSION['user_id']), allowing any authenticated user to execute it.
PoC Steps:
1. Login as a student-role user
2. Send POST request: POST /index.php?action=add_grade with body: add_grade=1&student_id=2&subject_id=1&term=12&score=100
3. Response contains "Grade successfully added"
4. Database confirms the grade was inserted for another student by a student-role user
Impact: A student can manipulate their own grades or sabotage other students' grades, compromising the academic integrity of the entire grading system. |
|---|
| ソース | ⚠️ https://www.sourcecodester.com/php/18686/cet-automated-grading-system-ai-predictive-analytics-php-and-mysql.html |
|---|
| ユーザー | Yogender (UID 99560) |
|---|
| 送信 | 2026年07月05日 11:48 (2 月 ago) |
|---|
| モデレーション | 2026年08月20日 09:20 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 393622 [SourceCodester CET Automated Grading System with AI Predictive Analytics /index.php add_grade 特権昇格] |
|---|
| ポイント | 20 |
|---|