The vulnerability is triggered by an insufficient authentication check in the admin/config.php file of the Student‑Management‑System. This flaw allows an unauthenticated or low‑privileged user to gain administrative access by manipulating requests or bypassing the expected authentication workflow. As a result, an attacker could read, modify, or delete configuration settings, potentially leading to a full compromise of the management system.

The affected product is ealpha072 Student‑Management‑System, up to the code revision 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. The public repository contains the vulnerable component in the Administrative Backend, but the project does not publish explicit version numbers for releases due to its rolling‑release model.

The CVSS score of 6.9 classifies the flaw as a moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation campaigns at the time of writing. However, the exploit code is publicly available, and the vulnerability can be triggered remotely, making it a realistic threat for exposed instances of the application.