| 标题 | SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 Improper Access Control |
|---|
| 描述 | A broken access control vulnerability exists in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The add_grade functionality in /index.php does not verify the user's role before processing the request. Any authenticated user, including those with the student role, can add or modify grades for any student in the system.
Affected File: /index.php
Affected Function: add_grade handler (line 190)
Affected Code:
if (isset($_POST['add_grade'])) {
$student_id = (int)$_POST['student_id'];
$subject_id = (int)$_POST['subject_id'];
$term = (int)$_POST['term'];
$score = (float)$_POST['score'];
$stmt = $pdo->prepare("INSERT INTO grades (student_id, subject_id, term, score) VALUES (?, ?, ?, ?)");
$stmt->execute([$student_id, $subject_id, $term, $score]);
}
Other state-changing actions (add_subject, add_user, edit_user, delete) correctly enforce $_SESSION['role'] === 'admin', but add_grade only checks isset($_SESSION['user_id']), allowing any authenticated user to execute it.
PoC Steps:
1. Login as a student-role user
2. Send POST request: POST /index.php?action=add_grade with body: add_grade=1&student_id=2&subject_id=1&term=12&score=100
3. Response contains "Grade successfully added"
4. Database confirms the grade was inserted for another student by a student-role user
Impact: A student can manipulate their own grades or sabotage other students' grades, compromising the academic integrity of the entire grading system. |
|---|
| 来源 | ⚠️ https://www.sourcecodester.com/php/18686/cet-automated-grading-system-ai-predictive-analytics-php-and-mysql.html |
|---|
| 用户 | Yogender (UID 99560) |
|---|
| 提交 | 2026-07-05 11時48分 (2 月前) |
|---|
| 管理 | 2026-08-20 09時20分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 393622 [SourceCodester CET Automated Grading System with AI Predictive Analytics /index.php add_grade 权限提升] |
|---|
| 积分 | 20 |
|---|