A critical authorization vulnerability in the Cyber-III Student-Management-System allows unauthenticated remote attackers to modify sensitive user data, posing a significant risk to data integrity.

The application fails to perform proper authorization checks in the /viva/update.php file, allowing any remote, unauthenticated attacker to supply a username and an arbitrary name value via an HTTP POST request to modify database records.

The ability for an unauthenticated user to modify the name field of any account, including administrative accounts, facilitates unauthorized data manipulation and potential social engineering attacks. Given the CVSS score of 7.3, this flaw represents a significant risk to system integrity and administrative trust, as it permits attackers to masquerade as other users or disrupt database consistency.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /viva/update.php endpoint via network-level controls or by disabling the vulnerable component if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous HTTP POST requests directed at /viva/update.php, particularly those originating from unauthorized or unexpected IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block POST requests to /viva/update.php unless they originate from trusted internal sources, and ensure that authentication requirements are strictly enforced at the application level.

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the GitHub issue report referenced by the CVE record.

Due to the lack of an official vendor patch and the public availability of technical reproduction steps, this vulnerability presents a credible risk to the integrity of the Student-Management-System. Organizations should prioritize isolating the affected component from the public internet and monitoring for unauthorized modification attempts until the vendor provides a secure update.