| Title | Yash Pokharna StudentManagementSystem 1.0 SQL Injection |
|---|
| Description | Describe the bug
Two critical issues exist in student_trans.php:
Broken Access Control: The script does not include session.php or call confirm_logged_in(), leaving the endpoint completely unauthenticated. Anyone can access it without a valid session cookie.
SQL Injection: User-supplied POST parameters (FIRST_NAME, Last_Name, EMAIL, etc.) are directly concatenated into an INSERT SQL statement without sanitization or parameterized queries.
An attacker can exploit this to insert arbitrary data (including malicious XSS payloads) into the database, or perform time‑based/error‑based SQL injection. |
|---|
| Source | ⚠️ https://github.com/yashpokharna2555/StudentManagementSystem/issues/3 |
|---|
| User | Levis1 (UID 96766) |
|---|
| Submission | 04/27/2026 10:44 (3 months ago) |
|---|
| Moderation | 05/24/2026 11:06 (27 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 365451 [yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203 student_trans.php confirm_logged_in FIRST_NAME/Last_Name/EMAIL sql injection] |
|---|
| Points | 20 |
|---|