Student Registration System
Monthly
SQL injection in lavkush-maurya Student-Registration-System 1.0 allows authenticated remote attackers to manipulate backend database queries via the unsanitized `oldpass` parameter in `/student/changepass.php`, potentially exposing or modifying student records. A proof-of-concept exploit has been publicly disclosed on GitHub, making exploitation trivial for any holder of a low-privileged student account. No vendor patch exists - the maintainer did not respond to coordinated disclosure - leaving all deployments of this version permanently unmitigated absent manual intervention.
SQL injection in lavkush-maurya Student-Registration-System 1.0 allows authenticated remote attackers to manipulate backend database queries via the unsanitized `oldpass` parameter in `/student/changepass.php`, potentially exposing or modifying student records. A proof-of-concept exploit has been publicly disclosed on GitHub, making exploitation trivial for any holder of a low-privileged student account. No vendor patch exists - the maintainer did not respond to coordinated disclosure - leaving all deployments of this version permanently unmitigated absent manual intervention.