CampCodes School Management Software Improper Authorization Vulnerability in Staff Handler Component

A critical vulnerability has been identified in CampCodes School Management Software version 1.0. The issue resides in the Staff Handler component, specifically within an unknown function of the file '/edit-staff/'. This vulnerability allows for improper authorization, enabling remote exploitation. The issue has been publicly disclosed and is associated with the Common Weakness Enumeration (CWE) identifiers CWE-285 and CWE-266.

Impact

Exploitation of this vulnerability could lead to unauthorized access and modification of sensitive data, including super admin privileges, according to the advisory.

Reproduction

The vulnerability can be reproduced by accessing the '/edit-staff/' page without proper authorization. The lack of adequate authorization checks allows users to manipulate staff data and potentially escalate privileges to super admin.