CVE-2026-97647

ningzichun student-management-system editLog.php authorization

View on CVE.org
Published Sep 25, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

A parameter manipulation vulnerability in editLog.php of the ningzichun student‑management‑system allows an attacker to override or inject values for sid, addtime, type, reason, detail, and logdate. By altering these arguments an attacker can bypass the intended authorization controls and modify or create log entries without permission, thereby compromising the integrity of audit trails and potentially revealing sensitive data.

Affected Systems

The vulnerability affects the ningzichun student‑management‑system, specifically all releases up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. No other versions are currently known to be vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. While no EPSS data is available, the exploit has been publicly disclosed and can be performed remotely, presenting a real threat. The vulnerability is not listed in CISA KEV, but an attacker with network access who can reach editLog.php could tamper with log parameters to bypass authorization.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the student‑management‑system to a version newer than commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf or apply the repository’s latest committed fixes.
  • If a patch is not available, restrict access to editLog.php by configuring the web server or firewall so that only authenticated administrators can reach it, and disable the ability to pass sid, addtime, type, reason, detail, or logdate parameters on public requests.
  • Monitor HTTP traffic to detect attempts to manipulate editLog.php parameters and alert security teams of suspicious activity.

Generated by OpenCVE AI on September 25, 2026 at 08:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title ningzichun student-management-system editLog.php authorization
First Time appeared Ningzichun
Ningzichun student-management-system
Weaknesses CWE-285
CWE-639
CPEs cpe:2.3:a:ningzichun:student-management-system:*:*:*:*:*:*:*:*
Vendors & Products Ningzichun
Ningzichun student-management-system
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-639

    Authorization Bypass Through User-Controlled Key

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 3:22 AM
Reserved
Sep 24, 2026, 6:53 PM

View source JSON

Updated
Sep 29, 2026, 3:22 AM

JSON

Status
Deferred
Published
Sep 25, 2026, 2:16 AM
Modified
Sep 29, 2026, 4:18 AM

View source JSON

No data.

Updated
Sep 25, 2026, 9:00 AM

JSON