Student Information System EUVD-2026-93018

Exploitation targets the searchquery.php script specifically, requiring the attacker to reach this endpoint over the network and supply a malicious value to a search parameter that is concatenated into a SQL query. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), implying default-configuration exploitation; however, a key LIMITING factor is that search functionality in this application class is frequently placed behind an application login, so authentication may in practice be required despite the PR:N rating - defenders should confirm whether searchquery.php is exposed pre-authentication. Exploitation is further scoped to version 1.0 of this specific SourceCodester product running a reachable PHP/MySQL stack.

This is a low-to-moderate real-world risk despite the network-reachable SQL injection. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation, which sounds alarming, but the impact metrics are deliberately capped at VC:L/VI:L/VA:L (and SC/SI/SA:N), yielding only a 6.9 (Medium) score - meaning the assessing source judged limited data exposure/modification rather than full database compromise. No EPSS score was provided, the CVE is NOT on the CISA KEV list, and the input carries no explicit POC=YES flag, so there is no public-signal evidence of active exploitation. The 'E:X' (Exploit Maturity: Not Defined) in the vector confirms exploitation status was left unassessed. The product is a free SourceCodester hobby/educational PHP application with negligible enterprise footprint, which strongly reduces practical priority. CAVEAT: the PR:N (unauthenticated) rating conflicts with the typical design of 'Simple Student Information System', where search endpoints like searchquery.php often sit behind an admin/user login - verify whether authentication is actually required before trusting the unauthenticated rating. One reference (github.com/lshhhhh318/cve/issues/1) is a third-party disclosure issue that may contain proof-of-concept details, but this cannot be confirmed from the provided metadata alone.

A remote attacker sends a crafted request to searchquery.php with malicious SQL injected into a search parameter, manipulating the backend query to read or alter student records. Because the CVSS vector lists PR:N, no credentials may be required, though the application's design suggests a login may gate the endpoint; the GitHub issue reference may document a working proof-of-concept.