Student Transcript System CVE-2026-9574

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no special configuration, and no user interaction are required - exploitation is viable against any network-accessible instance using default application behavior. The specific condition enabling exploitation is the absence of parameterized SQL queries for the studentId and cid parameters in /admin/modules/student/trans.php. The primary limiting factor is deployment scope: the application is a niche, self-hosted PHP educational tool, and internet-facing instances are expected to be few. The /admin/ path prefix may suggest the endpoint is intended for administrative users only, but the PR:N vector explicitly indicates no credentials are enforced at the vulnerable script level. No platform-specific, OS-level, or non-default configuration requirement has been identified.

The CVSS 4.0 base score of 5.5 (Medium) reflects limited scope impact (VC:L/VI:L/VA:L with no subsequent system impact), but the attack vector components - AV:N, AC:L, AT:N, PR:N, UI:N - represent a maximally permissive exploitation condition: remote, low-complexity, unauthenticated, no user interaction required. The E:P modifier confirms a proof-of-concept exists, which the VulDB entry and GitHub reference corroborate. Despite this, EPSS at 0.03% (9th percentile) indicates very low observed or anticipated exploitation probability, consistent with itsourcecode products being small-footprint, often self-hosted academic tools unlikely to be indexed or mass-scanned at scale. The vulnerability is not listed in CISA KEV, and there is no evidence of active exploitation. Real-world risk is limited primarily by deployment footprint: organizations running this specific application on internet-accessible infrastructure face meaningful database exposure risk, while the broader threat landscape impact is low.

An unauthenticated remote attacker identifies an internet-exposed instance of Student Transcript Processing System 1.0, then sends a crafted HTTP GET or POST request to /admin/modules/student/trans.php with a SQL injection payload embedded in the studentId or cid parameter (e.g., appending a UNION SELECT or boolean-blind probe). A publicly available proof-of-concept on GitHub (https://github.com/nidieaaa/test/issues/13) documents the exploitation technique. Successful exploitation enables the attacker to read, modify, or delete records in the underlying database, potentially exposing student academic records or administrative credentials.