Jessica.Xiao

**Name of the Vulnerable Software and Affected Versions** ningzichun student-management-system versions prior to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf **Description** An authorization bypass exists in the file `admin/fun/getStudent.php`. A remote attacker can exploit this by manipulating the `sid` argument, allowing them to bypass security checks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the file `admin/fun/getStudent.php` to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ningzichun student-management-system versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf **Description** A remote authorization bypass exists in the file `user/editLog.php`. This issue occurs when the arguments `sid`, `addtime`, `type`, `reason`, `detail`, or `logdate` are manipulated, allowing an attacker to bypass security checks. **Recommendations** As a temporary workaround, restrict access to the file `user/editLog.php` to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ningzichun student-management-system versions prior to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf **Description** A flaw in an unknown function allows remote attackers to perform a manipulation that results in cross-site request forgery, a type of attack that forces an authenticated user to execute unwanted actions on a web application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ningzichun student-management-system versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf **Description** A flaw exists in the `example lite.sql` file that allows a remote attacker to execute a manipulation leading to the use of default credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.