CyberRota Analysis
AI-GeneratedThe XueZhiSi Open Source Exam System versions up to 3.9.0 are vulnerable to a privilege escalation flaw in the teacher-end interface, specifically in the POST /api/teacher/user/page/list endpoint, where the role parameter can be manipulated by the requester. This vulnerability could allow an unauthorized user to gain elevated privileges, potentially compromising the integrity of the system. Organizations using this exam system should prioritize remediation to prevent unauthorized access and maintain security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester.