Fees Management System CVE-2026-10297

Exploitation requires low-privilege authenticated access to the Fees Management System (PR:L per CVSS vector) - an attacker must hold at minimum a standard application account, whether a student, staff, or administrative user. The vulnerable endpoint is specifically /manage_course.php and the injection point is the ID parameter transmitted in an HTTP request; no user interaction from any other party is required (UI:N). The application must be network-accessible (AV:N), which is the typical deployment model for a school fees management web app. Exploitation is limited by the credential requirement: purely unauthenticated external attackers cannot exploit this without first acquiring valid credentials. No non-default configuration is required - any deployment of the 1.0 release with this endpoint accessible is potentially vulnerable.

The CVSS 6.3 medium score is shaped by three competing signals: network accessibility (AV:N, AC:L) increases exposure, while the low-privilege requirement (PR:L) and unchanged scope (S:U) constrain it. Real-world risk sits above the raw score due to the E:P exploit modifier confirming publicly circulating PoC code - meaning the barrier to exploitation is reduced to credential acquisition rather than vulnerability research. RL:X (remediation level unknown) is a significant risk amplifier: no patch is confirmed, leaving defenders with only compensating controls. RC:R (reasonable confidence) indicates the report is credible but not yet independently validated by a second authoritative source. EPSS data was not provided, preventing probabilistic exploitation rate assessment. KEV absence suggests no confirmed mass exploitation at analysis time, but the combination of public PoC, low-complexity attack, and no patch warrants treating this as a near-term operational risk rather than a theoretical finding.

An attacker who has obtained low-privilege credentials to the Fees Management System - via phishing, credential stuffing, or a self-registration feature - sends a crafted HTTP request to /manage_course.php with a malicious SQL payload in the ID parameter, extracting the full database contents including student records, financial data, and credential hashes. Publicly available proof-of-concept code on GitHub lowers the skill threshold, enabling automated exploitation against multiple instances once credentials are obtained.