CVE-2026-10272

Vulnerability

The admin/deleteform.php script in a4m4/Student-Management-System up to commit f0c5f6842c5e8c431ff02b5260a565ca844df3a0 contains an improper authorization vulnerability [1]. The script fails to implement any session validation or authentication checks, such as session_start(), before processing incoming HTTP requests [1]. This allows the code path responsible for executing SQL DELETE statements to be reached by any user who can access the script directly [1].

Exploitation

An attacker can exploit this vulnerability remotely without requiring authentication or valid session cookies [1]. By sending a crafted HTTP GET request to admin/deleteform.php with a specific sid parameter, an attacker can trigger the deletion of arbitrary student records from the database [1]. The vulnerability is easily reproducible by navigating to the endpoint and providing an ID, which the server processes without redirecting the user to a login page [1].

Impact

Successful exploitation results in unauthorized data deletion and modification [1]. An attacker can wipe entire student databases by enumerating IDs or potentially leverage the sid parameter for SQL injection [1]. This leads to a loss of data integrity and availability, causing significant business disruption, and the lack of logging makes these actions difficult to trace [1].

Mitigation

No official patch or fix has been released by the project maintainers as of the publication date [1]. Users are advised to restrict access to the admin/ directory at the web server level or implement manual authentication checks within the affected PHP scripts to prevent unauthorized access.