提交 #864392: SourceCodester Online Examination & Learning Management System 1.0 No

Title: Insecure Direct Object Reference (IDOR) in view_students.php

An Insecure Direct Object Reference (IDOR) vulnerability exists in view_students.php of the CICT Portal (Online Examination & Learning Management System). The application accepts a "class_group" parameter in the URL to display student rosters but fails to verify that the authenticated user has permission to access the requested class group.

By manipulating the "class_group" parameter, any authenticated user can view student rosters for any class group, including classes they are not enrolled in or authorized to view. This exposes sensitive student information including ID numbers, full names, and enrollment status.

Affected File: view_students.php
Parameter: class_group
Example URLs:

http://localhost/cictportal/view_students.php?class_group=BSIT-3D

http://localhost/cictportal/view_students.php?class_group=BSIT-2B

Proof of Concept:

Login as any authenticated user (student account is sufficient)

Navigate to: http://localhost/cictportal/view_students.php?class_group=BSIT-3D

Change the "class_group" value to another group (e.g., BSIT-2B, BSIT-1A, BSIS-3A, etc.)

Observe that the system displays student roster data including ID numbers, full names, and enrollment status for the specified class group without any permission errors or redirects

Continue enumerating different class_group values to access all student rosters in the system

Impact:

Unauthorized access to student roster data across all class groups

Exposure of personally identifiable information (PII) including student ID numbers and full names

Privacy violation for all students in the system

Ability to enumerate all students by class group

Bypass of role-based access controls (intended for instructors only)

Root Cause:
The application uses a direct object reference (the "class_group" parameter) to retrieve student roster data from the database without implementing server-side authorization checks. The system authenticates the user but fails to authorize access to the specific class group object. The query likely uses a simple SELECT statement with a WHERE clause on class_group without verifying the user's relationship to that class.

Vulnerable Code (Estimated):
php

// Potentially vulnerable pattern
$class_group = $_GET['class_group'];
$stmt = $pdo->prepare("SELECT * FROM students WHERE class_group = ?");
$stmt->execute([$class_group]);
// No authorization check to verify user can view this class_group

Remediation:

Implement server-side permission checks before displaying student roster data

Verify the authenticated user is enrolled in or teaching the requested class group

Verify user role (e.g., only instructors can view rosters)

Use indirect references (UUIDs/tokens) instead of sequential/guessable class group names

Apply role-based access control (RBAC) to all object access

Implement the "deny by default" principle

Add database-level filtering to only return data the user is authorized to view

CWE: CWE-639 - Insecure Direct Object Reference
OWASP: A01:2025 - Broken Access Control

• 用户: Adnan (UID 96526)
• 提交: 2026-06-20 10時09分 (2 月前)
• 管理: 2026-08-06 10時39分 (2 months later)
• 状态: 已接受
• VulDB条目: 386535 [SourceCodester Online Examination & Learning Management System 1.0 view_students.php class_group 权限提升]
• 积分: 17