| tiêu đề | Soarkey StudentManagement e08f7f1d5015af407aa4cca0ada3dea189b4937e Authorization Bypass |
|---|
| Mô tả | The affected component is the administrative servlet exposed by `code/WebContent/WEB-INF/web.xml` and implemented in `code/src/service/AdminDao.java`. `AdminDao.doGet()` at lines 34-101 dispatches attacker-controlled `action` values to privileged handlers, including `query_all_user()` at lines 105-126, `insert_user()` at lines 129-148, `delete_user()` at lines 150-167, `insert_department()` at lines 215-233, and additional create/update/delete operations for departments, classes, students, courses, and grades, but it never verifies whether the requester is authenticated or holds the administrator role. A remote attacker can directly invoke `/StudentManagement/AdminDao?action=...` without logging in to disclose user data and modify core records. This results in full administrative compromise of application confidentiality and integrity. |
|---|
| Nguồn | ⚠️ https://github.com/Soarkey/StudentManagement/issues/32 |
|---|
| Người dùng | soulinda (UID 99812) |
|---|
| Đệ trình | 16/07/2026 18:38 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 30/08/2026 10:00 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 397121 [Soarkey StudentManagement/学生信息管理系统 đến e08f7f1d5015af407aa4cca0ada3dea189b4937e Administrative Servlet AdminDao.java AdminDao.doGet action nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|