StudentManagement CVE-2026-82620

Exploitation requires a valid low-privilege account on the StudentManagement application (PR:L per CVSS 4.0 vector) - unauthenticated external attackers cannot directly trigger the flaw without credentials. The vulnerable code path is specifically the course ranking feature (CourseDao.course_ranking()), which must be accessible to the logged-in user. No special non-default configuration is needed beyond a running deployment of the application. Exploitation is limited by the need for at least one valid account, and the product's educational/hobby nature means most instances are not exposed to the public internet.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a low-complexity, network-reachable flaw requiring only low-privilege authentication, and the E:P modifier confirms a public proof-of-concept exists. Impact is bounded - VC:L, VI:L, VA:L with no scope change to subsequent systems - consistent with a SQL injection that permits data access but likely does not yield OS-level code execution in this context. No EPSS score was provided, and the absence of a CISA KEV listing suggests no observed widespread in-the-wild exploitation at the time of reporting. The real-world risk is further dampened by the product's extremely narrow deployment footprint: this is a hobby-grade, educational open-source project unlikely to be running as an internet-facing production system in any significant enterprise environment. The PR:L constraint (valid credentials required) limits the attacker pool, though a disgruntled student or insider at a school running this system represents the realistic threat actor. The primary concern is the combination of public PoC and an unresponsive vendor - there is no patch timeline, meaning exposure is open-ended for any active deployment.

An attacker with a valid low-privilege account (e.g., a student user) sends a crafted HTTP request to the course ranking feature with a SQL injection payload in the cno parameter. Because input reaches the database query unsanitized, the attacker can enumerate tables, extract credentials or personal data for all students, or alter records. A public proof-of-concept is available via GitHub issue #33, requiring minimal technical skill to adapt.