A malicious actor can craft a request that the victim’s browser will send to the student‑management‑system, enabling the attacker to perform actions on the victim’s behalf without their knowledge. The vulnerability resides in an unspecified function of the application and is exploitable remotely, which means that any user who authenticates – or is tricked into opening the crafted URL – could be affected. The impact is a loss of integrity for operations performed through the affected endpoint, with potential downstream consequences for data and services the application relies on.

The student‑management‑system application built by ningzichun is affected; all releases up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf are vulnerable. No later versions are known to be patched. The software is open‑source, hosted on GitHub, and no vendor‑supplied patches have yet been released.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The attack vector is remote and the exploit is public, so an attacker can launch attacks from any network. The primary weakness is a lack of CSRF protection (CWE‑352) combined with insufficient authorization controls (CWE‑862).