CyberRota Analysis
AI-GeneratedThe Book-Management-System's Flask API endpoints lack proper authentication, specifically the @login_required decorator, exposing sensitive student personally identifiable information (PII) and complete book-borrowing histories to unauthenticated users. This vulnerability allows attackers to enumerate the entire student database by simply supplying sequential card_id values. Organizations using this system should prioritize remediation to protect student data and comply with privacy regulations.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.