CampCodes School Management Software Attachment Resource Injection Vulnerability

A resource injection vulnerability has been identified in CampCodes School Management Software version 1.0, specifically within the Attachment Handler component. This vulnerability arises from improper management of resource identifiers, allowing for insecure direct object reference (IDOR) exploitation. The issue can be exploited remotely, although the attack's complexity is considered high.

Impact

Exploitation of this vulnerability allows for insecure direct object reference, enabling unauthorized access to resources by manipulating sequential and guessable identifiers. This could lead to unauthorized downloading of homework assignments from other students.

Reproduction

To reproduce this vulnerability, access the application and navigate to the homework upload section. Each student's homework is assigned a unique, sequential ID that can be easily guessed. By manipulating these IDs, it is possible to download homework from other students in different classes.