Insecure Direct Object Reference in Assignment Creation Functionality in Gosfem School Management System

Summary

An Insecure Direct Object Reference (IDOR) vulnerability was identified in the assignment management functionality of the Gosfem School Management System.

The vulnerability allows an authenticated teacher account to create assignments for classes outside of its authorized scope by manipulating class identifiers within assignment creation requests.

As a result, teachers may create academic content for classes they are not assigned to manage, indicating missing server-side authorization checks.

Affected Component

• Product: Gosfem School Management System
• Component: Assignment Management
• Endpoint: /assignment/assignment
• Vulnerability Type: Insecure Direct Object Reference (CWE-639)

Technical Details

The application provides functionality for teachers to create assignments for their assigned classes.

However, authorization validation is not properly enforced on the server side during assignment creation. By modifying the class identifier associated with an assignment request, a teacher can create assignments for classes that are not assigned to their account.

The application processes the modified request and successfully creates the assignment despite the user lacking authorization over the targeted class.

This behavior demonstrates a failure to enforce object-level authorization controls.

Impact

Successful exploitation allows a teacher to perform unauthorized actions on academic resources belonging to other classes.

An attacker with a valid teacher account can create assignments for classes outside their assigned responsibilities, potentially causing:

• Unauthorized modification of academic content.
• Confusion among students and staff.
• Integrity issues affecting assignment management workflows.
• Cross-class privilege abuse by authenticated users.

The vulnerability represents a horizontal privilege escalation issue where one teacher can interact with resources belonging to another teacher's class.

Steps to Reproduce

1. Authenticate to the application using a teacher account.

2. Navigate to the assignment creation functionality.

3. Intercept the request sent to:

   http://localhost/assignment/assignment
   

4. Identify the parameter referencing the target class.

5. Modify the class identifier to a class not assigned to the authenticated teacher.

6. Submit the modified request.

7. Observe that the assignment is successfully created for the unauthorized class.

Remediation

The vendor should:

• Enforce server-side authorization checks for assignment creation requests.
• Verify that the authenticated teacher is authorized to manage the specified class before processing the request.
• Avoid relying on client-supplied identifiers for access control decisions.
• Implement object-level access control validation across all academic management functions.
• Conduct a review for similar authorization issues affecting classes, subjects, assignments, and student resources.

Credit

Discovered and reported by Suraj Kumar H M.