CVE-2026-105919 in Learning-Management-System
Summary
by MITRE • 10/06/2026
A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The identified vulnerability resides within the Kusalkasilva Learning Management System, specifically affecting versions up to commit ffeb873f8803f1e9664384ff75000c7da45466d2. The core technical flaw is located in the admin login endpoint, which utilizes a PHP script named login.php within an administrator component. This module handles user authentication by processing credentials submitted via HTTP requests to verify administrative access rights against a backend database.
The fundamental security deficiency is classified as SQL injection, corresponding to CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The vulnerability arises from the improper handling of input arguments for the username and password fields within the mysql_query function call. Instead of employing parameterized queries or prepared statements to safely separate code from data, the application directly concatenates user-supplied input into SQL query strings. This allows a remote attacker to inject malicious SQL syntax that alters the logic of the authentication query.
From an operational perspective, this vulnerability enables unauthenticated attackers to bypass administrative login controls entirely. By crafting specific payloads for the username or password fields, an adversary can manipulate the database response to return true for any valid user account or even extract sensitive data from the underlying database schema without requiring legitimate credentials. This represents a critical compromise of confidentiality and integrity within the system's access control mechanisms.
The threat landscape is significantly exacerbated by the fact that exploit code has been made public, lowering the barrier to entry for malicious actors who may lack advanced exploitation skills but can leverage existing tools to target vulnerable instances. Furthermore, because the project does not utilize semantic versioning or release tags, it is impossible to determine which specific builds are affected versus unaffected based on standard version identifiers alone. This ambiguity complicates vulnerability management and patch deployment efforts for system administrators relying on this software.
Industry frameworks such as MITRE ATT&CK categorize this type of attack under techniques related to credential access and privilege escalation, specifically noting how SQL injection can be used to bypass authentication controls (T1078) or extract data from databases (T1213). The lack of response from the project maintainers despite early notification through issue reports indicates a potential gap in security maintenance practices for this open-source component.
Mitigation strategies must prioritize immediate remediation given the public availability of exploits and the critical nature of administrative access. Developers should refactor the login.php script to replace direct mysql_query calls with PDO or MySQLi prepared statements, ensuring that all user inputs are treated as data rather than executable code. For organizations currently running this software, it is advisable to implement a Web Application Firewall rule set designed to detect and block SQL injection patterns in authentication endpoints until an official patch is released by the maintainers. Additionally, enforcing strong password policies and multi-factor authentication can provide secondary layers of defense against unauthorized access attempts resulting from such vulnerabilities.