| 제목 | Portabilis i-Educar 2.0 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 Improper Authorization |
|---|
| 설명 | A Broken Function Level Authorization (BFLA) vulnerability in the Final Status Import tool allows an authenticated user with 'School' level permissions to modify student records across any school unit by providing enrollment IDs in a CSV file. This bypasses institution-level isolation and allows for mass sabotage of academic data. |
|---|
| 원천 | ⚠️ https://github.com/ViniCastro2001/Security_Reports/tree/main/i-educar/BFLA-Final-Status-Import |
|---|
| 사용자 | vini_castro (UID 94745) |
|---|
| 제출 | 2026. 01. 21. PM 09:08 (9 개월 ago) |
|---|
| 모더레이션 | 2026. 02. 05. PM 08:32 (15 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 344597 [Portabilis i-Educar 까지 2.10 Final Status Import FinalStatusImportService.php school_id 권한 상승] |
|---|
| 포인트들 | 18 |
|---|