This vulnerability affects the ajax_forgot_password function in application/controllers/Login.php of the OUSL-GROUP-BrinaryBrains School Student Management System (commit 1e70e5ad1125b86dca4ee086eb6bb121f17708b6). Manipulating the email parameter in this password recovery endpoint results in weak password recovery mechanisms, potentially allowing unauthorized password resets. The attack vector is remote network access with no privileges or user interaction required, but the attack complexity is high. The vulnerability has a CVSS 4.0 base score of 6.3 (medium severity). The vendor has not issued any patch or official remediation, and the product lacks versioning, complicating identification of affected versions. Exploit code is publicly available, but exploitation remains difficult.

Successful exploitation could allow an attacker to bypass or weaken the password recovery process, potentially leading to unauthorized account access. However, the attack complexity is high, and no privileges or user interaction are required. There is no indication of privilege escalation, denial of service, or data confidentiality impact beyond the password recovery weakness. The exploit is public, which may increase the likelihood of attempted attacks despite the difficulty.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the issue report. Organizations using this system should monitor vendor advisories for updates. Until a fix is released, consider implementing additional controls around password recovery processes, such as multi-factor authentication or manual verification steps, if feasible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.