A manipulation of the sid parameter in the admin/fun/getStudent.php page allows an attacker to bypass normal authorization controls, thereby gaining unauthorized access to student information. The flaw is an example of CWE-285, an authorization bypass through a user‑controlled key, and it also exposes privilege escalation via information disclosure (CWE-639). The vulnerability can compromise confidentiality and integrity of the student data and could be leveraged to perform further attacks if the attacker obtains higher privileges. The exposed controller accepts the sid value without proper validation, effectively letting the attacker impersonate another user or access data they are not permitted to view.

The vulnerability exists in ningzichun’s open‑source Student Management System, in code revisions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. All installations using that revision or earlier have the flaw. The affected file is located under admin/fun/getStudent.php. No official patch or release is referenced in the data; users must verify whether newer commits address the issue or manually apply a patch.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not publicly available, so the exact likelihood of exploitation is unknown. The vulnerability is reachable remotely via the web interface, and the public exploit is already available as reported. Because the flaw allows overriding of authorization checks, it can be leveraged to access sensitive data or potentially elevate privileges. The vulnerability is not listed in the CISA KEV catalog, but the presence of an available exploit suggests that it could be abused by threat actors targeting the application. The likely attack vector is a standard HTTP request to the/getStudent.php endpoint, possibly from an unauthenticated user or one with limited access, where the sid parameter is tampered to reference a different user session or profile. No further prerequisites beyond remote HTTP access are mentioned, so the risk is high for exposed deployments.