Abbos Eshmirzayev

**Name of the Vulnerable Software and Affected Versions** Book-Management-System (affected versions not specified) **Description** Certain Flask API endpoints lack the `@login required` decorator, which is used to restrict access to authenticated users. This flaw allows unauthenticated remote users to retrieve student personally identifiable information (PII), including name, gender, card validity, and debt status, as well as complete book-borrowing history. The issue is exploitable via the following endpoints: '/student', '/record', '/books', '/find stu book', and '/find not return book'. By providing the `card id` variable, which consists of sequential integers, an attacker can enumerate the entire student database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/student', '/record', '/books', '/find stu book', and '/find not return book' endpoints to minimize the risk of exploitation.