Student-to-administrator escalation via missing role checks

Missing authorization in PHPGurukul Online Course Registration 3.0 and 3.1 allows remote authenticated users to access admin functions. Student login creates an authenticated session without recording a role, while administrative pages serve privileged content without verifying administrator authorization. A student account is required; direct requests to admin URLs grant access to user data and administrative course, student, and registration operations.