Portabilis i-Educar Broken Access Control Vulnerability in Enrollment History Endpoint

A broken access control vulnerability has been identified in Portabilis i-Educar versions through 2.10. The issue resides in the enrollment history endpoint, where improper access controls allow low-privileged users to access restricted functionalities. This vulnerability can be exploited remotely, bypassing authorization checks and potentially leading to unauthorized actions within the application.

Impact

Exploitation of this vulnerability allows low-privileged users to access functionalities reserved for higher-privileged users, such as batch unassigning students from classes. This unauthorized access could disrupt class management and student record integrity.

Reproduction

To reproduce this vulnerability, authenticate as a low-privileged user and send a GET request to the enrollment history endpoint, including the appropriate session cookie. The response will grant access to restricted functionalities that the user should not have.