EUVD-2026-53607
GHSA-5j46-xp25-hvc9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-accessible login form with no complexity barriers justifies AV:N/AC:L/PR:N/UI:N; limited database read/write impact and no scope change yield S:U/C:L/I:L/A:L.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in the imranrisal-dev Student-Management-System login component (loginCheckTest.php) allows unauthenticated remote attackers to manipulate backend database queries via the username and password parameters. A public exploit exists (CVSS 4.0 E:P modifier confirmed), making opportunistic exploitation immediately feasible with no authentication or special preconditions. The vendor was unresponsive to responsible disclosure, and no patch has been released, leaving all deployed instances of this repository permanently exposed.
Technical ContextAI
The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), which encompasses classic SQL injection. The affected component is loginCheckTest.php, a PHP script handling credential validation in this open-source Student Management System hosted on GitHub (commits 18ea7904c339e0c7b0234724a79c939ce6191def and a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c). The root cause is unsanitized user input from the username and password form fields being directly interpolated into SQL query strings rather than being handled via parameterized queries or prepared statements with bound parameters (PDO or MySQLi). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the attack surface is a publicly accessible HTTP endpoint with no complexity or configuration barriers.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the vendor was unresponsive to disclosure, making a coordinated fix unlikely. As an immediate compensating control, administrators should restrict public access to loginCheckTest.php via web server configuration - for Apache, a Deny directive in .htaccess; for nginx, a location block with return 403 - though this disables the login endpoint and requires an alternative authentication path. At the code level, any maintainer forking or maintaining this codebase should replace direct string interpolation in SQL queries with PDO or MySQLi prepared statements with bound parameters, which eliminates the injection surface entirely. Deploying a WAF with SQLi detection rules (e.g., ModSecurity CRS) can reduce opportunistic exploitation risk but is bypassable by skilled attackers and should not be treated as a permanent fix. Given the unresponsive vendor and absence of a patch, organizations should evaluate replacing this application with a maintained alternative. References: https://vuldb.com/vuln/386233 and https://github.com/winterbergnurullah551-sketch/sql-cves/issues/1.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today