Ventem e-School Missing Authorization Vulnerability Allowing Privilege Escalation

A missing authorization vulnerability has been identified in Ventem's e-School platform. This issue allows remote attackers with regular user privileges to access administrative functions. Exploitation of this vulnerability enables the creation, modification, and deletion of user accounts, as well as the escalation of any account to system administrator privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized access to administrative functions, allowing for account management and privilege escalation to system administrator level.

Remediation

Schools running the system on-premises should contact the vendor to confirm the update status or consider restricting access to the campus network only.