CVE-2026-10620 in Student Admission System
Summary
by MITRE • 06/03/2026
A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown function of the file /index.php. This manipulation of the argument eid/did causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/07/2026
The vulnerability identified in the code-projects Student Admission System 1.0 represents a critical sql injection flaw that undermines the application's database security posture. This weakness exists within the index.php file where an unknown function processes user input parameters, specifically the eid/did arguments that are susceptible to manipulation. The flaw allows attackers to inject malicious sql commands through these parameters, potentially compromising the entire database infrastructure. The vulnerability's remote exploitability means that attackers can leverage this weakness from external networks without requiring physical access to the system, making it particularly dangerous for web-facing applications. The publication of exploit code further amplifies the risk as it provides readily available tools for threat actors to compromise affected systems. This vulnerability aligns with CWE-89 which categorizes sql injection as a common weakness in web applications where untrusted data is incorporated into sql commands without proper sanitization or parameterization. The attack surface is expanded through the use of the eid/did parameters which likely serve as identifiers for educational institution data or student records, making the potential impact significant for sensitive academic information. According to ATT&CK framework, this vulnerability maps to T1190 - Exploit Public-Facing Application, representing a common attack pattern where adversaries target web applications to gain unauthorized access to backend systems. The remote nature of the exploit allows for scalable attacks against multiple installations of this software, potentially affecting educational institutions that have not patched their systems. The lack of proper input validation in the index.php file indicates a fundamental flaw in the application's security architecture, where user-supplied data flows directly into database queries without appropriate sanitization mechanisms. This weakness could enable attackers to extract sensitive information including student records, institutional data, and potentially administrative credentials. The exploitation of this vulnerability could lead to complete database compromise, allowing attackers to modify or delete critical educational data while maintaining persistence within the system. Organizations utilizing this software must urgently implement mitigations including input validation, parameterized queries, and proper access controls to prevent unauthorized database access and protect sensitive academic information from unauthorized disclosure or manipulation.