EUVD-2025-209446
GHSA-27pw-mrx7-45mq
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.
AnalysisAI
Time-based blind SQL injection in manikandan580 School Management System 1.0 allows unauthenticated remote attackers to extract sensitive database contents and potentially execute arbitrary SQL commands through the fromdate POST parameter in /studentms/admin/between-date-reprtsdetails.php. The CVSS 9.8 critical score reflects network-based exploitation requiring no privileges or user interaction, with complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though the specific vulnerable parameter and injection type are documented in public security advisories.
Technical ContextAI
This vulnerability affects a PHP-based school management system developed by manikandan580. Time-based blind SQL injection is a technique where attackers inject SQL commands that cause deliberate delays in database responses, allowing them to infer data through timing analysis even when error messages or direct output are not visible. The vulnerable endpoint /studentms/admin/between-date-reprtsdetails.php appears to be an administrative report generation function that accepts date range parameters. The fromdate POST parameter lacks proper input sanitization and parameterized query implementation, allowing attackers to append malicious SQL commands (such as WAITFOR DELAY or SLEEP functions) that the backend database executes. This vulnerability class enables complete database compromise through automated extraction techniques, even without direct query result visibility.
RemediationAI
Organizations must immediately implement input validation and parameterized SQL queries for the fromdate POST parameter in /studentms/admin/between-date-reprtsdetails.php using prepared statements with bound parameters appropriate to the backend database system (MySQLi or PDO for typical PHP deployments). No vendor-released patch identified at time of analysis; administrators should apply code-level fixes manually by replacing string concatenation with prepared statements in the vulnerable file. As interim mitigation, restrict network access to /studentms/admin/ paths using web application firewall rules or authentication gateway controls to limit exposure to trusted administrative networks only. Implement database account privilege separation ensuring the application database user cannot execute administrative commands beyond necessary CRUD operations. Review all date input handling throughout the application for similar SQL injection vulnerabilities, as this appears symptomatic of systemic input validation failures. Security advisory details available at https://github.com/TREXNEGRO/Security-Advisories/tree/main/CVE-2025-65135 provide technical documentation for remediation efforts.
Share
External POC / Exploit Code
Leaving vuln.today