This vulnerability in SourceCodester Student Grades Management System 1.0 arises from improper authorization checks in the getClassroomStudents and removeStudentFromClassroom functions within classroom.php. By manipulating the classroom_id parameter, an attacker with limited privileges can perform unauthorized actions related to classroom student data. The vulnerability is remotely exploitable without requiring user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. No official patch or vendor remediation level has been published as of now.

Successful exploitation allows an attacker with some privileges to bypass authorization controls and potentially access or modify classroom student information improperly. This could lead to unauthorized data exposure or modification within the student grades management system. The vulnerability does not require user interaction and can be triggered remotely, increasing its risk. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application functions to trusted users only and monitor for suspicious activity related to classroom_id parameters. Avoid exposing the application to untrusted networks if possible.