Online Student Result System
Monthly
SQL injection in SourceCodester Online Student Result System 1.0 exposes remote unauthenticated attackers a direct path to manipulate backend database queries via the unsanitized `id` parameter in `/view_result.php`. Successful exploitation can yield unauthorized access to student result records, partial data modification, and limited availability disruption. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% (8th percentile) signals negligible observed exploitation activity, consistent with the product's narrow educational/demo deployment footprint rather than any technical barrier to exploitation.
SQL injection in SourceCodester Online Student Result System 1.0 allows unauthenticated remote attackers to inject SQL commands via the Username field on the /login.php page. Exploit code is publicly available, but EPSS score of 0.03% (8th percentile) indicates a low likelihood of widespread exploitation, and the product is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in SourceCodester Online Student Result System 1.0 exposes remote unauthenticated attackers a direct path to manipulate backend database queries via the unsanitized `id` parameter in `/view_result.php`. Successful exploitation can yield unauthorized access to student result records, partial data modification, and limited availability disruption. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% (8th percentile) signals negligible observed exploitation activity, consistent with the product's narrow educational/demo deployment footprint rather than any technical barrier to exploitation.
SQL injection in SourceCodester Online Student Result System 1.0 allows unauthenticated remote attackers to inject SQL commands via the Username field on the /login.php page. Exploit code is publicly available, but EPSS score of 0.03% (8th percentile) indicates a low likelihood of widespread exploitation, and the product is not listed in CISA's Known Exploited Vulnerabilities catalog.