A flaw in the example_lite.sql file of the ningzichun student‑management‑system introduces default credentials that an attacker can use to log in. The weakness is insecure default credentials (CWE‑1392). When exploited, it provides an unauthorized user with a login session, but the specific privileges granted depend on the roles assigned to the default accounts. This flaw is limited to the database script and does not expose additional system components directly.

The vulnerability affects deployments of ningzichun student‑management‑system that use the example_lite.sql file, specifically any version up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. The affected product is the open‑source student‑management system hosted by the same project name.

The CVSS score of 5.1 places this issue in the moderate severity range. No EPSS score is available and it is not listed in the CISA KEV catalog. The description notes that the attack can be launched remotely, which means an external actor could attempt the exploit without needing local access. While no public exploit scripts are documented, the potential exists for an attacker that discovers the default credentials to gain unauthorized access, potentially exposing sensitive student data if the exposed accounts have administrative privileges. Until the default credentials are removed or updated, the risk remains.