Student-Management-System CVE-2026-82698

Exploitation requires two concurrent conditions: (1) the application is reachable over a network (the CVSS 4.0 AV:N vector confirms this is the intended attack surface - localhost-only deployments are not exposed), and (2) default credentials from aca.sql have not been changed after the SQL file was imported to set up the database. The CVSS 4.0 PR:N metric confirms no prior authentication is required - the default credential itself is the bypass mechanism. Limiting factors include: network accessibility (the application must not be firewalled or restricted to trusted IPs), knowledge that the target runs this specific software (required to know which defaults to try, though the repository is public and source identification is straightforward via application fingerprinting), and the defaults must remain unchanged post-install. Any deployment that rotated all credentials after import is not affected.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) accurately reflects a network-accessible, zero-complexity attack with limited data-exposure impact. The public proof-of-concept via GitHub issue #7 removes any technical barrier for low-skill attackers. However, no CISA KEV listing exists, and EPSS data was not provided in the available intelligence - without EPSS, likelihood of broad scanning campaigns cannot be quantified, though the trivial exploit path suggests automated targeting is feasible. The dominant risk-limiting factor is the extremely narrow deployment base: this is a niche, unmaintained student project with negligible enterprise presence, meaning the realistic victim pool is small even if exploitation is straightforward. The disparity between ease of exploitation (very high) and aggregate risk (low) is driven entirely by footprint - a high-CVSS finding on a ubiquitous product this easy to exploit would be urgent; here it is a low-priority tail risk for the few operators who deployed it publicly.

An attacker searches GitHub or Shodan for internet-exposed instances of this student management system, retrieves the publicly available aca.sql file from the repository to extract default credentials, and submits those credentials to the application login page without any prior authentication. Successful login grants access to whatever student records or administrative functions the default account holds. A public proof-of-concept is available via GitHub issue #7, making this immediately accessible to low-skill actors.