Student Management System EUVD-2026-35125

No special conditions - remote unauthenticated exploitation against default configurations of the imvks786 Student Management System admin login page. The CVSS 4.0 vector (PR:N/AC:L/AT:N/UI:N) confirms no privileges, no complexity, no additional attack requirements, and no user interaction are needed. The only prerequisite is network reachability to admin/admin_login.php. What limits exploitation in practice: the application is likely deployed in educational or small-institution environments rather than at internet scale, reducing the attacker population that would encounter it; however, no authentication, no complexity, and an already-public POC mean any network-accessible instance is immediately at risk from the moment of discovery.

The CVSS 4.0 base score of 5.5 (Medium) reflects low individual impact ratings (VC:L/VI:L/VA:L) on paper, but the attack conditions are maximally permissive: network-reachable, no authentication, no complexity, no user interaction (AV:N/AC:L/AT:N/PR:N/UI:N). The E:P modifier confirms a publicly available proof of concept, elevating real-world risk above the numeric score implies. In practice, SQL injection at an admin login page typically enables authentication bypass entirely - an attacker can log in as administrator without valid credentials - which makes the effective integrity and confidentiality impact higher than the CVSS Low ratings suggest. This product is not listed in CISA KEV, and no EPSS score was provided, so widespread automated exploitation is not confirmed. However, the combination of a public POC, an unresponsive maintainer, and no patch means defenders cannot expect a near-term vendor fix. The CVSS score likely underrepresents practical risk given the authentication bypass potential of login-targeted SQLi.

An unauthenticated remote attacker sends a crafted HTTP POST request to admin/admin_login.php with a SQL injection payload in the a_usr or a_pwd parameter - for example, setting a_usr to a value such as ' OR '1'='1'-- to manipulate the authentication query logic. Because a public proof-of-concept has been released via the project's GitHub issue tracker, the specific payload and technique are already disclosed and readily usable with no special tooling. Successful exploitation bypasses admin authentication, granting the attacker full access to the administrator panel and potentially all student records stored in the underlying database.