Student-Management-System EUVD-2026-64621

Exploitation requires a low-privileged authenticated session on the Student Management System, consistent with the PR:L metric in the CVSS 4.0 vector - fully unauthenticated external attackers cannot exploit this directly. The vulnerable parameters (roll_no and teacher_name) must be accessible via the Dashboard component, meaning the attacker's account must have permission to reach that interface. No non-default configuration or special platform condition is described. Exploitation is further limited by the fact that this is a niche hobby project: only operators who have self-hosted this specific GitHub repository are exposed. The database user's privilege level determines the ultimate blast radius of a successful injection.

The CVSS 4.0 score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) is reasonable: network-accessible with low attack complexity, but requiring authenticated access (PR:L), which moderates real-world exploitability. The E:P supplemental metric confirms a public exploit exists, elevating practical risk above the base score alone would suggest. However, there is no CISA KEV listing, and EPSS data was not provided. The most significant limiting factor is product obscurity - this is a personal hobby GitHub project with negligible enterprise or institutional deployment, meaning the aggregate exposure is low. No conflicting signals are present between the CVSS vector and the description. The authentication requirement (PR:L) is the primary friction point: exploitation is blocked for entirely unauthenticated external attackers. No SSVC data was supplied.

An attacker with a low-privileged account on the Student Management System navigates to the Dashboard interface and submits a crafted value such as roll_no=1' OR '1'='1 or teacher_name=admin'-- in the relevant input field. The unsanitized input is interpolated directly into the backend SQL query, allowing the attacker to enumerate student records, extract credentials, or modify data. A public proof-of-concept exists in GitHub issue #4, lowering the skill threshold required for exploitation.