This vulnerability involves improper control of resource identifiers in the 'marks' function of the Parents.php controller within the OUSL-GROUP-BrinaryBrains School Student Management System (up to commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6). An attacker can remotely manipulate the argument param1 to gain unauthorized control over resource identifiers. The system employs continuous delivery with rolling releases, complicating identification of affected or fixed versions. The vendor has not issued a response or patch, and no official remediation guidance is available. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability.

The vulnerability allows remote attackers to manipulate resource identifiers improperly, potentially leading to unauthorized access or modification of resources related to student marks. The impact is rated medium severity with low to limited confidentiality, integrity, and availability impacts. There are no confirmed active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or official fix is available, organizations should monitor for updates from the vendor or community. Until a fix is released, consider restricting access to the affected functionality or implementing compensating controls to validate and sanitize input parameters related to resource identifiers.