EUVD-2026-72244
GHSA-pxm5-36gh-jqwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing login page
-
DeliveryCraft SQL payload in email field
-
ExploitPOST request to User_Login.php
-
ExecutionInject into backend SQL query
-
PersistBypass authentication or extract DB records
-
ImpactAccess student or staff data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of itsourcecode School Management System 1.0. The email parameter on the login form is injectable without any prior authentication, session, or token. The only prerequisite is network reachability to the web server hosting User_Login.php. Exploitation is limited by: network exposure (the server must be internet-facing or on a network the attacker can reach), and the extent of database impact depends on the MySQL user privileges granted to the PHP application - a least-privilege DB user reduces but does not eliminate risk. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated remote exploitation with no complexity barriers, and the E:P modifier documents that public exploit code exists. The impact ratings VC:L/VI:L/VA:L reflect bounded but real database access - the login query can be manipulated to bypass authentication or enumerate records, though full database takeover depends on DB user privileges. No KEV listing is present and EPSS data was not provided, but the pre-auth attack surface and available PoC combine to make this an accessible target for automated scanners; even a mid-sized municipal IT team in swidnica running this software on an internet-facing server should treat this as urgent due to the zero-friction exploitation path. The primary limiting factor is the deployment footprint: itsourcecode projects are predominantly used in academic and hobbyist environments rather than large enterprise settings, which reduces aggregate blast radius but does not diminish per-instance severity. |
| Exploit ScenarioDerived | An unauthenticated attacker sends an HTTP POST request to User_Login.php with a SQL injection payload in the email field (for example, a classic OR-true bypass such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in User_Login.php, injecting arbitrary SQL into backend database queries at the pre-authentication login endpoint. With a public exploit available on GitHub, exploitation requires minimal skill and no credentials. The CVSS 4.0 vector confirms network-accessible, no-privilege exploitation with partial confidentiality, integrity, and availability impact against the underlying database.
RemediationAI
No vendor-released patch has been identified at time of analysis. The primary fix is to rewrite the email parameter handling in User_Login.php to use PHP PDO or MySQLi prepared statements with parameterized queries, which eliminates the injection surface entirely. As an immediate compensating control, deploy a web application firewall rule targeting SQL injection patterns on the login endpoint. If the application does not require internet exposure, restrict access to trusted IP ranges at the network perimeter. Disabling the email login field entirely (if an alternative auth path exists) removes the vulnerable parameter. Each workaround carries trade-offs: WAF rules can be bypassed with encoding; IP restriction limits legitimate access. Manual patching of the open-source PHP code is the only confirmed durable fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 (SQL Injection) flaw in a PHP-based school administration application distributed freely by itsourcecode.com. The login file User_Login.php constructs database queries using unsanitized user-supplied input from the email POST parameter, without using prepared statements or parameterized queries. The CPE cpe:2.3:a:itsourcecode:school_management_system:*:*:*:*:*:*:*:* uses a wildcard version, indicating the flaw is present across all tracked releases. itsourcecode projects are PHP/MySQL stacks commonly deployed on shared hosting or LAMP servers by educational institutions and students as ready-made solutions.
Know when School Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Pre-auth network-accessible login SQLi; impacts limited to partial DB read/write; availability impact not established from description.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in School Management System
View allSchool Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport paramet
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the sid parameter at
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the password paramete
SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent chang
Mojoomla School Management System for WordPress allows SQL Injection via the id parameter. Rated high severity (CVSS 8.8
Exploit-DB