A flaw in the admin/deleteform.php file of a4m4 Student-Management-System allows an attacker to manipulate the sid argument, bypassing the intended authorization checks and deleting records without proper privilege. The vulnerability is an improper authorization flaw, rooted in CWE-266 and CWE-285, that can be exploited remotely by unauthenticated or improperly authenticated users who direct requests to this endpoint. The impact is the loss of data integrity and potential data loss, as records can be removed at the attacker’s discretion.

The affected product is a4m4 Student-Management-System. No specific version numbers are listed because the project uses rolling releases; the vulnerable state exists in the code base up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0.

The flaw carries a CVSS score of 6.9, indicating moderate severity. EPSS data is not available, so the precise exploit probability is unknown, but the fact that the vulnerability can be triggered remotely and the public disclosure of an exploit raise the risk profile. The vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is a remote HTTP request to deleteform.php with a crafted sid parameter, possibly from an unauthenticated or minimally privileged user.