Society Membership System CVE-2026-86267

Exploitation requires a valid user account on the target instance (CVSS PR:L confirmed). The attacker must be able to reach the /society/check_student.php endpoint over the network. No special non-default configuration is needed beyond having any authenticated session. Limiting factors: a valid credential is required (registration may or may not be open depending on deployment); the vulnerable product is an educational demo application with minimal real-world production deployments; and the impact is constrained to the application's database, which in typical deployments contains only membership and student records.

The VulDB-assigned CVSS 4.0 score of 5.3 (VC:L/VI:L/VA:L) is likely understated for a SQL injection vulnerability - CWE-89 flaws routinely yield full database confidentiality and integrity compromise, not merely low-level partial impact. The network attack vector, low complexity, and low privilege requirement (PR:L) are accurate signals. A public proof-of-concept exists (E:P), elevating exploitation likelihood. However, real-world operational risk is substantially bounded by prevalence: itsourcecode distributes educational demo code with negligible production deployment footprint. No CISA KEV listing exists and no EPSS data was provided. The most plausible risk scenario is developers copying this codebase into production environments without addressing injection flaws. The authentication requirement (PR:L) provides a marginal barrier but should not be relied upon given that student-level accounts are often self-registerable.

An authenticated attacker - for example, a registered student - submits an HTTP GET or POST request to /society/check_student.php with a crafted student_id value such as 1 UNION SELECT username,password,3 FROM users--. The unsanitized input is incorporated into the SQL query, causing the database to return credential data or other sensitive records in the response. A public proof-of-concept demonstrating this technique is available at https://github.com/anglemsg2401-bot/cve/issues/5.