CVE-2026-10169

Vulnerability

The Forgot Password endpoint in the School Student Management System (commit up to 1e70e5ad1125b86dca4ee086eb6bb121f17708b6) contains a business logic flaw. In application/controllers/Login.php, the ajax_forgot_password function accepts an email via POST and immediately resets the corresponding account's password to a random string derived from md5(rand(...)) without any verification (no CAPTCHA, security questions, email token, or current password check). The response differs between existing and non-existing emails, allowing account enumeration. This affects all versions up to the mentioned commit; the product does not use versioning [1].

Exploitation

An attacker with remote network access sends a POST request to /index.php?login/ajax_forgot_password with the target's email. The endpoint returns {"status":"true"} and changes the password in the database to a predictable (weak random) string. By sending a non-existent email, the attacker receives an HTTP 500 error, enabling enumeration of valid teacher/student/admin email addresses [1]. No authentication, rate limiting, or user interaction is required; the attack has high complexity due to the difficulty of predicting the random password, but public exploit code exists [1].

Impact

Successful exploitation allows an attacker to enumerate valid accounts and forcibly reset the password of any teacher, student, or admin account whose email is known or enumerated. The attacker can then log in as that user, gaining access to the system with the compromised user's privileges. This results in unauthorized access, potential data disclosure, and further system compromise [1].

Mitigation

As of the available references, no fix has been released by the vendor. The project was notified via an issue report but has not responded [1]. Until a patch is provided, the application is vulnerable. Administrators should consider disabling or restricting access to the forgot password endpoint, implementing proper email-based verification tokens, adding CAPTCHA, rate limiting, and ensuring responses do not reveal account existence [1].