This vulnerability affects SourceCodester Student Grades Management System version 1.0. The issue lies in improper authorization checks within the getClassroomStudents and removeStudentFromClassroom functions in classroom.php. By manipulating the classroom_id parameter, an attacker with limited privileges can perform unauthorized actions related to classroom student data. The vulnerability is remotely exploitable and has been publicly disclosed. No vendor advisory or patch information is provided, and the remediation level is unknown.

Successful exploitation allows an attacker to bypass authorization controls and potentially access or modify classroom student data without proper permissions. This could lead to unauthorized data exposure or modification within the affected system. The CVSS 4.0 base score is 5.3, indicating a medium severity impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to classroom_id parameter manipulation. Avoid exposing the vulnerable functions to untrusted users where possible.