Student Management System CVE-2026-11530

The target must be a deployed instance of imvks786/student_management_system with the Login page at /index.ph network-reachable to the attacker and backed by a SQL database; no authentication, no user interaction, and no special configuration is required because the injection lives in the pre-authentication login handler itself. Limiting factors are the niche deployment footprint of this specific GitHub project (likely small, self-hosted educational installations rather than enterprise SaaS), and that the attacker must be able to reach the /index.ph endpoint over HTTP/HTTPS, so instances behind VPNs, internal-only networks, or IP allowlists are not externally reachable.

CVSS 7.3 with vector AV:N/AC:L/PR:N/UI:N reflects a network-reachable, low-complexity, unauthenticated attack - strong indicators of practical exploitability. The E:P (Proof-of-Concept exploit) and RC:R (Reasonable confidence) temporal metrics align with VulDB's confirmation that publicly available exploit code exists. No EPSS score was supplied in the input and the CVE is not on CISA KEV, so widespread automated exploitation cannot be confirmed; however, the low scope/impact triplet (C:L/I:L/A:L) reflects that this is a small, likely self-hosted educational project rather than enterprise-deployed software, which limits real-world blast radius. The realistic risk is high for any internet-exposed instance of this specific application but low at an industry-wide level given limited deployment footprint and unresponsive upstream.

An unauthenticated remote attacker sends a POST request to /index.ph with a crafted usr value such as admin' OR '1'='1'-- and any pwd, bypassing authentication and returning the first row in the users table to log in as that account. Publicly available exploit code per VulDB lowers the skill barrier; a follow-on UNION-based injection through the same parameters can be used to exfiltrate the full student and credential database from the underlying MySQL/MariaDB instance.