EUVD-2026-68360
GHSA-qp7f-gch7-vxwq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SQL injection requiring low-privilege authentication; limited and contained impact on database confidentiality, integrity, and availability with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseDao.course_ranking of the file code/src/dao/CourseDao.java. Performing a manipulation of the argument cno results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
SQL injection in Soarkey StudentManagement (学生信息管理系统) allows authenticated remote attackers to read from or manipulate the backing database by supplying malicious input to the cno parameter of the CourseDao.course_ranking() method. All versions up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e are affected with no vendor patch available, as the project maintainer has not responded to the disclosure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege account on the StudentManagement application (PR:L per CVSS 4.0 vector) - unauthenticated external attackers cannot directly trigger the flaw without credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a low-complexity, network-reachable flaw requiring only low-privilege authentication, and the E:P modifier confirms a public proof-of-concept exists. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - the Soarkey project maintainer has not responded to the disclosure filed via GitHub issue #33. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Studentmanagement
View allAuthorization bypass in Soarkey StudentManagement (学生信息管理系统) exposes administrative functions to unauthenticated remote
Privilege escalation in Soarkey StudentManagement allows unauthenticated remote attackers to self-assign arbitrary privi
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today