CVE-2026-10777

Vulnerability

A vulnerability exists in the administrative backend of the ealpha072 Student-Management-System up to commit 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Specifically, the admin/config.php file includes a commented-out session_start(); call, preventing any session initialization. This affects potentially all pages under the admin/ directory, including admin/dashboard.php [2]. The project uses a rolling release model, so specific version numbers are not disclosed [1].

Exploitation

An attacker can exploit this vulnerability by sending a direct GET request to an administrative page, such as admin/dashboard.php, without requiring any authentication or valid session cookies. The absence of session_start() means that any subsequent checks for logged-in administrators will fail, allowing unauthenticated access to the administrative interface [2].

Impact

Successful exploitation allows any unauthenticated remote attacker to gain full access to the administrative backend. This includes the ability to view, add, edit, and delete students, courses, units, and departments, effectively compromising the integrity and confidentiality of the system's data [1, 2].

Mitigation

As of the available references, no patch or fixed version has been released, and the project has not yet responded to the issue report [1, 2]. There are no disclosed workarounds. The project's rolling release system means specific version information for fixes is not provided [1].