A vulnerability in the Student Dashboard component of Sambitraj's Student Management System allows an attacker to alter the roll_no parameter in a mysqli_query call, resulting in improper authorization. This flaw permits unauthorized users to retrieve data that should be restricted to authenticated roles, potentially exposing sensitive student information. The weakness maps to CWE-266 and CWE-285, highlighting inadequate permission checks and authorization controls.

The affected product is Sambitraj Student Management System, specifically the Student Dashboard module accessed via student_dashboard.php. No fixed or fixed versions are publicly disclosed due to the product's rolling release model, so any deployment incorporating the identified code commit or earlier is potentially vulnerable.

The CVSS score of 5.3 places this vulnerability in the medium severity range. The EPSS score is not available, and it is not listed in the CISA KEV catalog, yet the vulnerability is publicly known and can be exploited remotely through crafted input to the roll_no argument. Attackers can target the application endpoint directly, and no authentication bypass is required beyond the flawed authorization logic. The lack of a documented fix amplifies the risk, making it crucial for operators to assess the current state of the codebase and apply mitigations promptly.