This vulnerability in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f involves improper authorization in the HTTP POST request handler component, specifically in the /viva/update.php file. An attacker can remotely manipulate the 'Name' argument to bypass authorization checks. The vulnerability was reported early to the project, but no response or patch has been issued. The product's rolling release model means no fixed versions are currently identified. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

The vulnerability allows remote attackers to bypass authorization controls by manipulating a POST parameter, potentially leading to unauthorized actions within the Student-Management-System. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts. There are no known exploits in the wild at this time.

No official fix or patch is currently available for this vulnerability. Since the vendor has not responded and the product uses a rolling release model without versioned patches, users should monitor the vendor's channels for updates. Until a fix is released, consider restricting access to the affected endpoint and implementing additional access controls or monitoring to detect unauthorized usage.