Student data disclosure via unchecked email lookup

Incorrect access control in Institute-of-Current-Students 1.0 allows remote attackers to disclose student data through mydetailsstudent.php. The endpoint uses the attacker-controlled myds email value to select and return a student record without checking requester identity or authorization. No authentication is required, and changing the email value enables enumeration and disclosure of students' personal information.