CVE-2026-10271

Vulnerability

The a4m4 Student-Management-System (up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0) contains an authentication bypass vulnerability within the admin/ directory [1]. The access control logic checks for a valid session but fails to call exit; or die; after issuing a header('location: ../login.php') redirect [1]. Consequently, the PHP interpreter continues executing the remainder of the script, rendering the protected administrative content despite the redirect header [1].

Exploitation

An attacker does not require authentication or a valid session to exploit this flaw [1]. By sending a standard GET request to any protected file within the admin/ directory, such as admin/updatestudent.php, the attacker receives the 302 redirect header alongside the full HTML body of the restricted page [1]. The attacker simply ignores the redirect instruction and reads the response body to access the administrative functionality [1].

Impact

Successful exploitation results in a complete bypass of backend authentication, allowing unauthorized users to view, modify, or delete sensitive student records and system configurations [1]. Furthermore, because the administrative forms and action scripts are exposed, an attacker can leverage this access to perform additional attacks, such as SQL injection or stored XSS, potentially leading to a full system compromise [1].

Mitigation

No official fix has been released by the project maintainers, and the project has not responded to the reported issue [1]. Users are advised to manually modify the affected PHP files in the admin/ directory to include an exit; or die; statement immediately following the header() redirect call to ensure script execution terminates for unauthenticated requests [1].