Student-Management-System CVE-2026-78057

Exploitation requires a valid low-privilege authenticated session on the Student-Management-System web application, consistent with PR:L in the CVSS 4.0 vector. The attacker must be able to submit HTTP requests to the Management Mutation Handler endpoint with attacker-controlled values in at least one of the following parameters: roll_no, name, father_name, class, mobile, email, password, or remark. No special server-side configuration beyond a running instance of the application is required. The primary factor limiting exploitation is the low-privilege authentication prerequisite - unauthenticated exploitation is not supported by the CVSS vector. Impact is further bounded by the database account's privilege level; a least-privilege database user reduces the consequence of successful injection.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation with no user interaction required, but gated behind a low-privilege authentication requirement. Scored impact is low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), yielding the low overall score of 2.1. However, the CVSS 4.0 score likely understates practical risk: SQL injection impact is highly dependent on database account privileges, and in misconfigured deployments could escalate to full database exfiltration or write operations beyond the rated low impact. A publicly available POC (E:P) lowers the barrier for exploitation. No KEV listing means active exploitation is unconfirmed. EPSS data was not provided in the input. The project has not responded to responsible disclosure, making remediation indefinitely blocked - a meaningful operational risk signal absent from the numeric score.

An attacker with a valid low-privilege account logs into the Student-Management-System and submits a crafted SQL payload (e.g., a UNION-based or boolean-blind injection string) into one of the vulnerable parameters such as roll_no or email within the Management Mutation Handler. A publicly available proof-of-concept at GitHub issue #5 demonstrates working injection payloads against the application. Depending on the database account's privileges, the attacker could exfiltrate student PII, modify academic records, or enumerate the database schema.