College Management System EUVD-2026-15180

The CVSS:3.1 score of 6.3 reflects a medium-severity risk with important qualifying factors. The attack vector is Network (AV:N), making it remotely exploitable without physical access; attack complexity is Low (AC:L), meaning no special conditions are needed; and Privileges Required (PR:L) indicates an attacker must have valid authenticated access as a low-privileged user. The impact is Confidentiality, Integrity, and Availability (C:L, I:L, A:L), allowing partial data theft, modification, and denial of service. Real-world risk is elevated beyond the base CVSS score because: (1) a public proof-of-concept exploit exists on GitHub (exploitation status: unproven but publicly available), (2) the authentication barrier (PR:L) reduces but does not eliminate risk for multi-user systems where students or junior staff have accounts, and (3) administrative functions like student result entry are high-value targets. SSVC perspective: exploitation is publicly demonstrated, technical impact is database compromise, and the automatable nature of SQL injection attacks increases likelihood. This is a genuine priority for organizations running College Management System 1.0, particularly if user account enumeration or credential compromise is a precursor threat.

An authenticated user with administrative access (such as a junior staff member or compromised account) navigates to the add-single-student-results.php page. Instead of entering a legitimate course code, the attacker submits a malicious SQL payload in the course_code parameter, such as course_code=1' OR '1'='1, or a UNION-based injection to extract user credentials and grade data. Because input validation is absent and the parameter is directly interpolated into an SQL query, the injected SQL is executed by the database server. The attacker exfiltrates the entire student database, modifies grades, or drops tables. The public GitHub proof-of-concept (referenced at https://github.com/ltranquility/submit/issues/3) documents the exact injection vectors, enabling rapid exploitation by unskilled attackers using simple payload mutation techniques.