Student Result Manager CVE-2025-11551

Exploitation requires valid authentication credentials (PR:L in CVSS vector). An attacker must first obtain legitimate login access to the Student Result Manager application through credential compromise, social engineering, or default credentials. No special product configuration is required; the vulnerability is present in the default installation of version 1.0. The SQL injection payload is injected through the roll number, student name, or GPA input fields in the student management interface. The underlying database connection must execute the injected SQL (typical for Java applications using direct JDBC without parameterization), which is the default condition.

This vulnerability presents minimal real-world risk despite being exploitable. The CVSS:4.0 vector (PR:L/AV:N/AC:L/UI:N) correctly reflects that exploitation requires valid login credentials (PR:L), significantly reducing the threat surface. The EPSS score of 0.03% (8th percentile) indicates extremely low probability of exploitation in the wild, placing this well below typical organizational risk thresholds. While publicly available exploit code exists, the combination of authentication requirement, narrow scope (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N indicating no scope expansion), and niche product deployment suggests limited practical impact. The vulnerability is exploitable but not a priority for most organizations unless they operate this specific student information system with exposed network access.

An authenticated user with valid login credentials submits a crafted SQL injection payload in the roll number, student name, or GPA field (e.g., a roll parameter containing 'OR 1=1 --'). The unvalidated input flows directly into a SQL query executed against the student database, allowing the attacker to extract additional student records, modify grades, or delete data depending on database privileges.