Authenticated student-data disclosure via class-group tampering

Authorization bypass in SourceCodester Onlne Examination & Learning Management System 1.0 allows remote authenticated users to read student data. The view_students.php endpoint processes an attacker-controlled class_group value without enforcing the intended authorization boundary; the responsible function is undisclosed. A valid low-privilege account is required, and the published impact is limited to reading data outside the account's authorized class group.