PHPGurukul Student Information System CVE-2026-82424

Exploitation requires a valid low-privilege user account within PHPGurukul Student Information System (confirmed by PR:L in the CVSS 4.0 vector). The attack targets the /student_edit1.php endpoint over the network (AV:N), so the application must be reachable - internet-facing deployments face higher exposure than those restricted to campus-internal networks. No special non-default configuration of the application is required; the vulnerability exists in the default handling of the ID parameter in this endpoint. The primary limiting factor is the authentication prerequisite: an unauthenticated external actor cannot directly exploit this without first acquiring credentials through phishing, credential stuffing, or other means. Impact is additionally bounded by the CVSS Low ratings on confidentiality, integrity, and availability, meaning full exfiltration or system compromise is not the immediate outcome of a single injection without further chaining.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) and score of 5.3 (Medium) reflect a network-reachable, low-complexity attack bounded by a low-privilege authentication requirement and limited per-dimension impact. No EPSS score is provided in the available data, so probabilistic exploitation likelihood cannot be independently quantified. This CVE is not listed in CISA KEV, meaning confirmed active exploitation is not established. However, the publicly available proof-of-concept on GitHub materially raises near-term opportunistic risk - exploit availability is a stronger near-term signal than EPSS for niche academic software of this type. PHPGurukul Student Information System targets educational institutions, primarily in South Asia, so exposed deployments are geographically and institutionally concentrated rather than broadly distributed across enterprise environments. The authentication requirement (PR:L) is the primary brake on mass exploitation; attackers must first obtain valid application credentials before leveraging this flaw.

An attacker who has obtained low-privilege credentials for the student information system submits a crafted HTTP request to /student_edit1.php with a manipulated ID parameter embedding SQL metacharacters, causing the backend database to execute attacker-controlled query logic. With a public proof-of-concept available on GitHub (https://github.com/Bai-public/CVE/issues/8), an attacker can adapt the exploit with minimal effort to enumerate tables, extract student records or credentials, or modify grades and enrollment data. The low attack complexity and absence of user interaction requirements mean exploitation can be scripted and repeated without ongoing attacker engagement.