Student Transcript System EUVD-2026-31963

The vulnerable parameter is id in the GET request to /admin/modules/class/index.php?view=view, which is part of the application's administrative interface. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms exploitation requires no prior authentication, no user interaction, and no special attack conditions - the endpoint must simply be network-reachable. No special configuration beyond a running default installation of version 1.0 is required. Exploitation is limited by the following factors: the application must be accessible over a network (local or internet) - entirely local deployments with no network interface are not reachable; impact is confined to the application's own database with no lateral scope change (SC:N); and the application's niche, self-hosted deployment model reduces the population of exposed instances. There is no indication of a non-default feature toggle or unusual configuration required to trigger the vulnerability.

The CVSS 4.0 base score of 5.5 (Medium) reflects a tension between maximally favorable attacker conditions (AV:N/AC:L/AT:N/PR:N/UI:N - network-reachable, no complexity, no prerequisites, no interaction) and low partial impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no scope change. SSVC corroborates the automatable flag, meaning scripted mass-scanning is viable once instances are identified. EPSS at 0.03% (9th percentile) is notably low given the public POC, suggesting this niche educational application sees limited attacker targeting at scale - consistent with a self-hosted, small-deployment profile rather than a widely-deployed enterprise product. No CISA KEV listing means active exploitation is not confirmed by a government authority. The CVSS E:P modifier (exploit proof-of-concept) is embedded in the vector, raising the exploitability component slightly. Net assessment: this is a real, exploitable vulnerability with a public POC and no patch, but realistic risk is bounded by the application's narrow deployment footprint and partial-only database impact; organizations running internet-exposed instances should treat this as high priority.

An unauthenticated remote attacker sends a crafted HTTP GET request to the target's admin panel - e.g., /admin/modules/class/index.php?view=view&id=1 UNION SELECT username,password,3 FROM users-- - and the unsanitized id value is directly interpolated into the backend SQL query, returning injected data in the application response. A public proof-of-concept demonstrating this technique has been published at https://github.com/nidieaaa/test/issues/14, further lowering the barrier for script-based exploitation. Because the SSVC framework rates this as automatable, an attacker could script discovery of exposed instances and bulk-extract database contents including student records and potentially stored credentials.