KusalkaSilva LMS CVE-2026-105921

Exploitation requires an authenticated low-privileged account (CVSS PR:L) with access to the class-search functionality that reaches search_class.php; the attacker then manipulates the school_year request argument to inject SQL. No special non-default configuration or user interaction is required (UI:N, AC:L), and the attack is remotely launchable over the network (AV:N). The primary limiting factor is the authentication requirement - anonymous/unauthenticated users cannot reach the vulnerable parameter - which meaningfully constrains exposure compared to a pre-auth flaw. Because the product is rolling-release with no version identifiers, defenders cannot pin exploitation to a specific patch level.

This is a CWE-89 SQL injection in the KusalkaSilva Learning-Management-System via the school_year parameter in search_class.php. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3 (Medium) and signals network-reachable, low-complexity exploitation that nonetheless requires low-level privileges (PR:L), i.e. an authenticated account - so this is not an unauthenticated internet-facing flaw. Publicly available exploit code exists (VulDB), which raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation; POC availability is a distinct signal from in-the-wild use and should not be conflated. The E:P (Proof-of-Concept) exploit-maturity value in the vendor vector is consistent with the POC-only status. The impact metrics are all rated Low (VC:L/VI:L/VA:L), suggesting partial rather than full database compromise, which is unusual for SQLi and may understate real impact - a classic SQLi can often be escalated to full data disclosure, so verify the actual query context with the vendor. Net assessment: a real but moderate-priority issue, gated by authentication and affecting an obscure hobby/open-source product with no vendor response yet, rather than a high-urgency widespread threat.

An attacker who holds a low-privileged application account logs in and submits a crafted value in the school_year argument to search_class.php, injecting SQL that the backend executes against the database. Because a public proof-of-concept exists (linked from the project's GitHub issue tracker), a relatively unskilled attacker could reproduce the injection to read or tamper with database records. The low attack complexity makes reliable exploitation straightforward once authenticated.