The vulnerability resides in the marks function of the Parents controller. By supplying a crafted value in the param1 argument, an attacker can override the intended resource identifier, leading to unauthorized access or modification of student mark data. This flaw falls under improper control of resource identifiers (CWE‑99) and can compromise the confidentiality and integrity of the system by allowing users to read or update marks that they should not have permission to access.

The affected product is the OUSL‑GROUP‑BrinaryBrains School Student Management System. All releases up to the commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6 are vulnerable. No patched releases have been published as of the last update.

The CVSS base score of 5.3 indicates moderate severity. The exploit is reported publicly and can be triggered remotely, but the EPSS score is not available, making precise exploitation likelihood uncertain. The vulnerability is not listed in the CISA KEV catalog, but a direct resource‑identifier injection attack could still be employed, posing a realistic risk to any organization using the affected system without a fix.