Cak File Management System EUVD-2026-114257

Exploitation targets the admin/save_student.php endpoint and requires supplying a malicious value in one of the specific parameters that reach the mysqli_query call: date, department, subject, forwarded_to, action_taken_by, section, or password. The attack is remote over the network. The key limiting factor is the endpoint's 'admin/' location, which suggests an administrative interface that may require authentication - the supplied CVSS vector claims PR:N (unauthenticated), but this is not corroborated by the description and should be verified against the source, since a login requirement would materially reduce exploitability. No special non-default configuration is described as a prerequisite, and no fixed version is available because the project has not responded.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VC:L/VI:L/VA:L yields a Medium score of 6.9, and the low (rather than high) confidentiality/integrity/availability impacts are the main thing holding it below High. The SSVC/vuln.today decision label is 'this_month', not act_now or emergency, which is consistent with a real-but-not-urgent issue. This is NOT in CISA KEV, so there is no public evidence of active exploitation, and no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from the input. A public PoC reference exists (the vendor issue report on GitHub) but it is not verified as working exploit code, so the 'E:P' (Proof-of-Concept) maturity should not be read as weaponized or in-the-wild. One conflicting signal to verify: the vulnerable file is 'admin/save_student.php', whose 'admin/' path implies an administrative area that might require authentication, yet the supplied CVSS vector states PR:N (unauthenticated) - this discrepancy should be confirmed against the actual code, because real-world risk is far lower if the admin panel enforces a login. Net: a genuine SQL injection worth patching on a normal cycle, not a drop-everything emergency, and its practical risk is further tempered by the product's near-zero deployment footprint.

A remote attacker sends a crafted request to admin/save_student.php with a malicious value in one of the injectable parameters (e.g. date, department, section, or password), which is concatenated into a mysqli_query call, allowing the attacker to alter the SQL statement and read or modify database contents. A public PoC reference exists via the project's GitHub issue, but it is not verified as working exploit code. If the admin endpoint in fact requires a login, the attacker would first need valid/administrative access, lowering practical exploitability.