A proof-of-concept security demonstration showing how exposed student data from Jaipur National University's ERP portal can be organized, searched, and analyzed.
🌐 Deployed URL: https://jnuparrot.in
JNU Parrot is a security research project built to demonstrate the real-world impact of an information disclosure vulnerability discovered in the Jaipur National University ERP portal.
The project uses a database of student records obtained through the identified vulnerability to illustrate how exposed personal information can be indexed, searched, analyzed, and presented through a modern web interface.
Its purpose is to raise awareness about the importance of securing educational ERP systems and protecting sensitive student information. The application combines AI-powered search, automated profile summaries, image analysis, and an administrative dashboard to demonstrate the potential consequences of publicly accessible data.
Disclaimer: This project exists solely for cybersecurity research, vulnerability demonstration, and educational purposes.
- Browse and search the exposed student database.
- View detailed student profiles containing available personal, family, academic, and address information.
- Fast search across thousands of records.
- Natural-language search powered by Groq LLMs.
- Automatically generated profile summaries.
- AI-assisted question answering for individual student profiles.
- AI vision analysis of available student profile photographs.
- Generates human-readable descriptions of visible physical characteristics.
A built-in censorship mode demonstrates how sensitive information should be protected.
When enabled, it masks fields such as:
- Mobile numbers
- Email addresses
- Aadhaar numbers
- Parent names
- Addresses
- Academic information
This allows the application to demonstrate privacy-preserving data presentation while retaining the original dataset internally.
Includes administrative tools for:
- Visitor analytics
- Search statistics
- Event logs
- Database activity monitoring
- Privacy mode management
- Python
- Flask
- SQLite (student records)
- PostgreSQL / Supabase (application settings, analytics, logs)
- Groq API
- Meta Llama models
- HTML
- CSS
- JavaScript
- TailwindCSS
- Cloudinary
- Python 3.x
pip install -r requirements.txtCreate a .env file or configure the following variables:
DATABASE_URL=
GROQ_API_KEYS=
SECRET_KEY=
CLOUDINARY_CLOUD_NAME=
python app.pyOpen:
http://127.0.0.1:5000/
This project demonstrates how a vulnerability exposing sensitive student information can be transformed into a searchable database, highlighting the risks of inadequate access controls and insecure ERP implementations.
It is intended to help security researchers, developers, and educational institutions better understand the impact of information disclosure vulnerabilities and encourage stronger security practices.
This repository is published for educational, research, and vulnerability demonstration purposes only.
The objective is to promote responsible security practices and raise awareness of the importance of protecting sensitive personal information in educational systems.
Creator & Developer: ROZ
Support: jnu.parrot@protonmail.com