C.P. Rivera

**Name of the Vulnerable Software and Affected Versions** Surya2Developer Hostel Management Service version 1.0 **Description** A problematic issue has been found in the Password Change Handler component, specifically affecting the /change-password.php file. The manipulation of the `oldpassword` argument leads to cross-site request forgery. This issue can be initiated remotely. **Recommendations** For Surya2Developer Hostel Management Service version 1.0, consider disabling the password change functionality in the /change-password.php file until a patch is available. Restrict access to the Password Change Handler component to minimize the risk of exploitation. Avoid using the `oldpassword` argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Surya2Developer Hostel Management System version 1.0 **Description** A critical issue was found in the system, affecting an unknown function of the file /admin/manage-students.php. The manipulation of the `del` argument leads to improper access controls, allowing remote attacks. The issue has been publicly disclosed and may be exploited. **Recommendations** For Surya2Developer Hostel Management System version 1.0, as a temporary workaround, consider restricting access to the /admin/manage-students.php file until a patch is available. Avoid using the `del` argument in the affected file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Surya2Developer Hostel Management Service version 1.0 **Description** A vulnerability has been found in the HTTP POST Request Handler component, specifically in the file /check availability.php. The manipulation of the `oldpassword` argument leads to observable response discrepancy. The attack can be launched remotely, with a rather high complexity and difficult exploitation. The exploit has been disclosed to the public and may be used. **Recommendations** For Surya2Developer Hostel Management Service version 1.0, as a temporary workaround, consider restricting access to the /check availability.php file until a patch is available. Additionally, avoid using the `oldpassword` argument in the affected HTTP POST Request Handler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.