SEVERITY RATING: 9/10

Your school's management panel has an unprotected API allowing attackers to scrape that API for student data to harvest.

API endpoint affected: https://axcel.schoolmgmtsys.com/index.php/invoices/invoice/{invoicenumber}

The issue

The API endpoint does not have an authentication layer over it. The API endpoint outputs any invoices it is requested to grab; it does not ask for authentication or any credentials to access other people's invoices.

How it works

Visit the API endpoint that is affected and make sure to put the range of numbers into the url at {invoicenumber} (870 - 16533).

What would the attacker do and get?

An attacker could run a python script scraping all of this JSON data from that specific API and harvest student data which contains:

• Payment data (payment amount, payment discount, payment discounted, paid amount, payment status, payment date, payment due date, if its notified of due, the discount id, if its due today, if there are any late fees, what currency is used to pay)
• The student's address and the school's address
• School system email
• School phone number
• The student's full name
• If the account is activated
• When the student is enrolled in the school (in unix epoch time)
• The student's birthday (in unix epoch time)
• The student's gender
• The student's current sector (secondary or primary)
• The student's status (still a student or graduated)
• The student's phone number
• The student's medical condition (blood group, weight, height, if disabled, what contact did he get)
• The student's father and mother and their email and phone
• The firebase token (extremely bad, could send push notifications to that phone)
• The student's photo
• How many merit points it has
• How many demerit points it has
• The lock in fee
• When was the merit and demerit point updated
• What classname it is in
• Sport house of the student
• And a lot more

Potential consequences

Estimated exposed invoices: 15663. I found the range of accessible invoices (16533 - 870) and subtracted it to get the potential invoices that could be leaked.

How to replicate

Visit https://axcel.schoolmgmtsys.com/index.php/invoices/invoice/1001 — full student data loads without any authentication needed.

Potential solution

I suggest you make it authenticated and only accessible to that user only (add a /mine endpoint or something like that) instead of showing all the invoices.