The vulnerability is located in the POST handler for /index.php?action=view_student. By altering the ID argument supplied in a POST request, an attacker can bypass the application’s authorization checks and retrieve student data that should be protected. This improper access control flaw allows an unauthenticated user to access confidential records without valid credentials, resulting in unauthorized data disclosure. The flaw is classified as CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key).

SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0. Any deployment that exposes the /index.php?action=view_student endpoint to external users without enforcing proper authentication and authorization is susceptible.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of <1% suggests a low likelihood of exploitation at present. The vulnerability can be exploited remotely by sending a crafted POST request that manipulates the ID field. Although not listed in the CISA KEV catalog, the public disclosure of an exploit means that attackers may target vulnerable systems that have not applied mitigations.