Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-2481: Surya2Developer Hostel Management System: Unauthorized Access via Manage Students

CVE-2024-2481 · published 2 years ago

Summary

A critical vulnerability in the Surya2Developer Hostel Management System allows an attacker to access data they shouldn't. This could happen if an attacker manipulates certain data, potentially from a remote location. Update the software to a fixed version to protect against this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
surya2developer	hostel_management_system	1.0 `cpe:2.3:a:surya2developer:hostel_management_system:1.0:::::::*`

Original advisory text

A vulnerability, which was classified as critical, was found in Surya2Developer Hostel Management System 1.0. Affected is an unknown function of the file /admin/manage-students.php. The manipulation of the argument del leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-256890 is the identifier assigned to this vulnerability.

References

https://github.com/blackslim3/cve_sidequest/blob/main/poc/Broken_Access_Control%... Exploit Third Party Advisory
https://vuldb.com/?ctiid.256890 Permissions Required Third Party Advisory
https://vuldb.com/?id.256890 Third Party Advisory VDB Entry

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-284Improper Access Control

Timeline

Published15 Mar 2024

Updated3 Nov 2026

First seen14 Mar 2026

Sources

CVE-2024-2481 · OSV

CVE-2024-2481 · NVD

Track software like this

Free during beta