This vulnerability in Kushan2k student-management-system up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a allows an attacker to manipulate the isadmin argument in the edit-admin function of the AdminController.php file, resulting in improper authorization. This flaw occurs at the Profile Update Endpoint and can be exploited remotely without user interaction. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low complexity, no privileges required, and no user interaction. The vendor has not provided a patch or official remediation, and the rolling release nature of the product means no fixed versions are specified. Public exploit code is available, but no known exploitation in the wild has been reported.

An attacker can remotely exploit this vulnerability to gain unauthorized administrative privileges by manipulating the isadmin parameter in the Profile Update Endpoint. This improper authorization could allow privilege escalation within the system, potentially compromising administrative functions. The CVSS score of 5.3 indicates a moderate impact with limited complexity and no required privileges or user interaction.

No official patch or remediation has been provided by the vendor as of the publication date. Since the product follows a rolling release model and no fixed versions are specified, users should monitor the vendor's channels for updates. Until a fix is available, restrict access to the Profile Update Endpoint and implement additional access controls or input validation to mitigate unauthorized manipulation of the isadmin parameter.