CyberRota Analysis
AI-GeneratedThe teacher-end interface in XueZhiSi Open Source Exam System versions up to 3.9.0 is vulnerable to vertical privilege escalation, allowing authenticated teacher users to delete administrator accounts without proper authorization checks. This flaw can lead to unauthorized access and potential disruption of administrative functions within the system. Organizations using this software should prioritize remediation, especially those with sensitive user roles and data management responsibilities.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation.