Logging in with their public ID number and date of birth sounds like a huge security risk.
If ID is public like you say, the date of birth of the person associated with that ID can easily be discovered. It would be trivial to either know (if the potential attacker knows the victim with it being a localised system), retrieve (e.g. via social media), guess or brute force the date of birth. Brute forcing the date of birth across all accounts if the IDs are sequential would be easy as only narrow date range would be required, assuming most students are born around the same year for a given range of IDs.
Of course, students can change their passwords to something else, but if they are not required to by the system the risk is not significantly lowered. I would guess that most users would not bother to change their password as their DOB is easily remembered.
Using HTTPS is good, although you have no idea how the information is stored and secured on their back-end systems.
You should talk to a lecturer or somebody at the college with your concerns, although often these concerns can fall on deaf ears. However, I would not go about trying to prove any vulnerabilities as there are all too many stories out there such as this one. If you did have any proof though, it might be best to submit it to the college anonymously on printed paper printed on a public printer to prevent printer steganography from identifying you.