Student Details Management System EUVD-2026-33448

No special conditions are required beyond network reachability - the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms remote unauthenticated exploitation against the default configuration of code-projects Student Details Management System 1.0. The sole prerequisite is that the /index.php endpoint is reachable by the attacker and that the roll parameter is processed by the application in its default state. No authentication, session token, or prior foothold is required. Exploitation is limited by: the application being publicly network-exposed (not localhost-only deployments); the application running version 1.0 of this specific product; and the backend database user having sufficient privileges to return meaningful data via injected queries - if the DB account is restricted to SELECT on a single table, post-exploitation escalation (e.g., reading other tables or writing files) may be constrained.

The CVSS 4.0 score of 5.5 (Medium) reflects partial impact across all three pillars (VC:L/VI:L/VA:L), but the attack surface characteristics are severe: AV:N/AC:L/AT:N/PR:N/UI:N means any internet-exposed instance is reachable by an unauthenticated attacker with no preconditions. The E:P modifier in the CVSS 4.0 supplemental metrics confirms a publicly available proof-of-concept, elevating practical risk above the raw score suggests. This CVE is not listed in CISA KEV, and EPSS data was not provided in the source intelligence, so exploitation prevalence in the wild is unconfirmed. However, the combination of a trivial attack vector, zero privilege requirements, and a public PoC on GitHub makes opportunistic exploitation realistic. The product appears to be a small educational or hobby application from code-projects.org and is unlikely to be deployed in critical infrastructure, which limits blast radius at a population level - but individual deployments handling real student PII should treat this as high priority due to the data sensitivity.

An unauthenticated attacker identifies a publicly accessible instance of the Student Details Management System and submits a crafted HTTP GET or POST request to /index.php with a SQL injection payload in the roll parameter (e.g., roll=1' UNION SELECT username,password,3 FROM users--). The application passes this value directly into a SQL query without sanitization, returning database contents - including potentially stored credentials or student PII - in the application response. The attacker's path is further shortened by the public PoC repository on GitHub (https://github.com/Xmyronn/Student-Details-Management-System-1.0---SQL-Injection-Unauthenticated-.git), which likely provides a ready-made payload or script.