A parameter manipulation vulnerability in editLog.php of the ningzichun student‑management‑system allows an attacker to override or inject values for sid, addtime, type, reason, detail, and logdate. By altering these arguments an attacker can bypass the intended authorization controls and modify or create log entries without permission, thereby compromising the integrity of audit trails and potentially revealing sensitive data.

The vulnerability affects the ningzichun student‑management‑system, specifically all releases up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. No other versions are currently known to be vulnerable.

The CVSS score of 6.9 indicates moderate severity. While no EPSS data is available, the exploit has been publicly disclosed and can be performed remotely, presenting a real threat. The vulnerability is not listed in CISA KEV, but an attacker with network access who can reach editLog.php could tamper with log parameters to bypass authorization.