The source code of the Student Grades Management System includes a function named removeStudentFromClassroom in the file classroom.php. By manipulating the classroom_id argument that the function accepts, an attacker can invoke the removal of a student from a classroom that they do not have permission to manage. This improper authorization flaw could lead to unauthorized data modification and loss of record integrity. The vulnerability is exploitable remotely and has been publicly disclosed. The weakness maps to CWE‑285 (Improper Authorization) and CWE‑266 (Weak Password Requirements).

This flaw affects SourceCodester Student Grades Management System, version 1.0, which is a web‑based classroom management application.

The associated CVSS score of 5.3 marks the vulnerability as medium severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting a lower likelihood of active exploitation in the wild. However, because the flaw can be triggered via a simple HTTP request that modifies a classroom_id value, the attack vector is remote and does not require privileged credentials. If an attacker can gain access to a user’s session or craft a request on behalf of a user, they could remove students from classrooms, potentially compromising data integrity and trust in the system.