This vulnerability arises from improper control of resource identifiers in the marks function of the Parents.php controller within the OUSL-GROUP-BrinaryBrains School Student Management System (up to commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6). An attacker can remotely manipulate the param1 argument to affect resource access or behavior improperly. The system uses continuous delivery with rolling releases, complicating version tracking and patch identification. The vendor has been notified but has not issued any response or fix as of the publication date.

The vulnerability allows remote attackers to manipulate resource identifiers improperly, potentially leading to unauthorized access or modification of resources related to student marks. The CVSS 4.0 score of 5.3 reflects a medium impact with low attack complexity and no required user interaction. However, the exact impact depends on how the manipulated identifiers affect system behavior, which is not detailed in the available data.

No official patch or remediation is currently available, and the vendor has not responded to the issue report. Since the product uses continuous delivery with rolling releases, users should monitor vendor communications closely for updates. Until a fix is provided, consider restricting access to the affected function or implementing additional input validation controls if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.