College Management System EUVD-2026-12427

While the CVSS base score of 4.7 appears moderate, the risk assessment is complex when considering all exploitation signals. The CVSS vector reveals a critical mitigating factor: this vulnerability requires high privileges (PR:H), meaning an authenticated administrator account is necessary to exploit it, significantly reducing the real-world attack surface compared to unauthenticated vulnerabilities. However, the public exploit disclosure (E:P) and confirmed proof-of-concept existence elevate practical risk for organizations running this system. The attack vector is network-based with low complexity (AV:N/AC:L), suggesting straightforward exploitation once authenticated. The technical impact is moderate with confidentiality, integrity, and availability all slightly compromised (C:L/I:L/A:L). For organizations using this College Management System, the primary risk vector is a compromised or malicious administrator account; the vulnerability itself is not a critical internet-facing threat due to privilege requirements, but represents a significant insider threat. The reliability rating of X (unknown) and remediation of X (unknown patch status) suggest this is a legacy or unmaintained product, making patching uncertain.

An authenticated administrator with malicious intent or a compromised administrator account can navigate to the /admin/courses.php page and inject SQL code into the course_code parameter, such as course_code=' OR '1'='1 or similar payloads, which would bypass SQL query logic and allow them to extract sensitive student or course data from the underlying database, modify course information, or potentially escalate further privileges. Since the vulnerability requires high privilege level access, the typical attack chain would involve credential compromise or social engineering to obtain administrator credentials first, followed by exploitation of this SQL injection to cause data exfiltration or corruption.