EUVD-2026-72127
GHSA-fpcp-wqr6-25pf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to university.php
-
DeliveryInject SQL payload into book_name/book_author parameter
-
ExploitBypass absent input validation in mysqli_query()
-
ExecutionExecute attacker-controlled SQL against backend database
-
ImpactExtract or tamper with database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against any internet-accessible or network-reachable deployment of Mstfakts College-Management-System where the Front-end/university.php Search Handler is reachable. No authentication is required, no specific non-default configuration is needed, and the attack requires no user interaction. The primary limiting factor is deployment footprint: this is a niche academic/hobby project unlikely to be deployed at scale in enterprise environments. Exploitation is bounded to the database layer - direct OS command execution is not established from available data. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the vulnerability is trivially reachable from the network with no authentication or user interaction, placing it in the highest accessibility bracket. However, the impact metrics (VC:L/VI:L/VA:L) indicate only limited confidentiality, integrity, and availability impact, consistent with a SQLi that permits data enumeration rather than direct OS-level compromise. The E:P exploit maturity modifier confirms public PoC availability, elevating practical urgency beyond what the 6.9 score alone suggests. No EPSS score was provided in the input data, and no CISA KEV listing exists, so widespread active exploitation is not confirmed. The product's obscure, likely academic deployment footprint substantially limits the real-world attack surface, making this a low-priority finding for most organizations despite the no-auth network vector. |
| Exploit ScenarioDerived | A remote unauthenticated attacker sends an HTTP GET or POST request to the publicly accessible Front-end/university.php endpoint, injecting SQL syntax (e.g., a UNION SELECT or boolean-based blind payload) into the book_name or book_author parameter. The unsanitized input is passed to mysqli_query(), causing the database to execute the attacker-controlled query and return or modify data. A working proof-of-concept has been published in GitHub Issue #5, meaning exploitation requires minimal skill. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 06, 2026
SQL injection in Mstfakts College-Management-System exposes the Search Handler endpoint (Front-end/university.php) to unauthenticated remote exploitation via unsanitized book_name and book_author parameters passed directly to mysqli_query(). A working proof-of-concept has been publicly disclosed via GitHub Issue #5, and the project maintainer has not responded to the disclosure, leaving the codebase unpatched. No public exploit identified as actively exploited in the wild at time of analysis, but the low attack complexity and no-authentication requirement combined with public PoC materially elevate practical risk.
RemediationAI
No vendor-released patch is available at time of analysis - the project maintainer has not responded to the disclosure per the GitHub issue report. The primary fix is to refactor Front-end/university.php to replace direct mysqli_query() string concatenation with parameterized queries using mysqli_prepare() and bind_param(), or alternatively migrate to PDO with prepared statements - this eliminates the injection vector at the root cause level. As a compensating control for deployments that cannot be immediately patched, restrict network access to the university.php endpoint to trusted internal networks or authenticated sessions only; this trades some search availability for attack surface reduction. Deploying a web application firewall (WAF) with SQLi detection rules (e.g., ModSecurity with OWASP CRS) can filter known payload patterns but should not be treated as a primary mitigation given bypass techniques exist. No vendor advisory URL is available; the issue tracker at https://github.com/Mstfakts/College-Management-System/issues/5 is the only reference.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is a PHP-based web application for academic institution management, identified by CPE cpe:2.3:a:mstfakts:college-management-system:*:*:*:*:*:*:*:*. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input from the book_name and book_author HTTP parameters is concatenated into a SQL query and passed unsanitized to the PHP mysqli_query() function in Front-end/university.php. This classic pattern - absent prepared statements or parameterized queries - allows an attacker to inject arbitrary SQL syntax. The vulnerability exists within the Search Handler component of the front-end layer.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible unauthenticated SQLi with no scope change; low C/I/A impact consistent with data-layer access only, not OS compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/university.php of the component Search Handler. The manipulation of the argument book_name/book_author results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB