CVE-2026-10225 in student_management_system_by_php
Summary
by MITRE • 06/01/2026
A vulnerability was detected in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. This issue affects some unknown processing of the file login_check.php of the component Login. Performing a manipulation of the argument Username results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/01/2026
This vulnerability represents a critical sql injection flaw in the student_management_system_by_php application that affects the login_check.php component. The vulnerability arises from improper input validation when processing the Username argument, creating an attack vector that allows remote exploitation. The issue stems from the application's failure to properly sanitize or escape user input before incorporating it into sql queries, which directly violates secure coding practices and creates a pathway for malicious actors to manipulate database operations.
The technical implementation of this vulnerability occurs within the login_check.php file where the Username parameter is directly used in sql construction without adequate sanitization measures. This flaw falls under the category of cwe-89 sql injection as defined by the common weakness enumeration, where untrusted data is incorporated into sql commands without proper validation or escaping. The rolling release model employed by this project complicates remediation efforts since version identification becomes challenging, and the lack of specific release information makes it difficult to determine which builds contain the fix or are vulnerable.
The operational impact of this vulnerability is severe as it enables remote attackers to execute arbitrary sql commands against the underlying database system. Attackers can leverage this weakness to extract sensitive information including user credentials, student records, and other confidential data stored within the system. The public availability of exploitation tools further amplifies the risk, as demonstrated by the fact that the exploit is already in use within the cybersecurity community. This vulnerability directly maps to attack techniques described in the attack pattern taxonomy under the category of sql injection attacks, where adversaries seek to bypass authentication mechanisms and gain unauthorized access to backend databases.
The lack of response from the project maintainers following the initial issue report creates an extended window of exposure for users of this software. This delay in remediation represents a critical gap in the security lifecycle management, as the vulnerability remains exploitable for an indefinite period. Organizations utilizing this system should implement immediate mitigations including input validation measures, database query parameterization, and network segmentation to limit potential attack surface. The vulnerability also highlights the importance of maintaining updated security practices in open source projects, where the responsibility for security updates often falls to the community rather than centralized maintainers, creating potential gaps in vulnerability response times.