weiweik/tronclass-api-bug

This repository is a responsible disclosure report documenting several security problems found in TronClass, an online learning platform used at universities. The author, a student, discovered that multiple TronClass API endpoints check whether a user is logged in but do not check whether that user is actually allowed to access the specific resource they requested. This class of bug is called BOLA (Broken Object Level Authorization) or IDOR (Insecure Direct Object Reference) and is listed in standard security vulnerability catalogs. The most serious issue documented here allows any logged-in student to send an API request that promotes another account, including their own, to the teacher role in any course. Once promoted, that account would theoretically have instructor-level access to that course. Other documented problems include any student being able to retrieve the full attendance list for any class session (including personal identification codes for each student), fetching the QR code used to mark attendance during an active session, reading the enrollment access code for courses, and downloading exam statistics files containing student personal data and answers. The root cause described in the report is that some API endpoints, including older ones that were never properly retired, are missing the middleware step that would check permissions at the object level. The platform asks only whether the requester holds a valid login session, not whether that session belongs to someone who should be allowed to see or change the requested resource. The repository includes an OpenAPI specification file that formally describes each vulnerability, sample JavaScript code showing how each endpoint can be called, and a local documentation server using Swagger UI so readers can browse and test the specification in a browser. The repository is framed strictly as a security education resource and responsible disclosure, not as an exploitation toolkit. The author states their intent is for the TronClass developer to fix these issues before a future release.