Submit #992659: KusalkaSilva Learning-Management-System ffeb873f8803f1e9664384ff75000c7da45466d2 SQL Injection

The affected components are the session-protected pages of the application that read request parameters and interpolate them into SQL statements. Representative files and code:

```php
// search_class.php
$sy = $_POST['school_year'];
$school_year_query = mysql_query("select * from school_year where school_year = '$sy'")or die(mysql_error());
...
$query = mysql_query("select * from teacher_class
LEFT JOIN class ON class.class_id = teacher_class.class_id
LEFT JOIN subject ON subject.subject_id = teacher_class.subject_id
where teacher_id = '$session_id' and school_year = '$school_year' ")or die(mysql_error());
```

```php
// announcements.php / my_students.php / print_student.php / class_calendar.php /
// edit_post.php / subject_overview.php / downloadable.php / downloadable_student.php ...
$get_id = $_GET['id'];
... mysql_query("select * from teacher_class_student where teacher_class_id = '$get_id' ...")or die(mysql_error());
```

```php
// update_password.php (teacher) and update_password_student.php
$new_password = $_POST['new_password'];
mysql_query("update teacher set password = '$new_password' where teacher_id = '$session_id'")or die(mysql_error());
```

```php
// read.php / read_teacher.php
$id=$_POST['selector'];
... mysql_query("insert into notification_read (student_id,student_read,notification_id) values('$session_id','yes','$id[$i]')")or die(mysql_error());
```

```php
// edit_post.php
mysql_query("update teacher_class_announcements set content = '$content' where teacher_class_announcements_id = '$id' ")or die(mysql_error());
```

All of these pages only require a logged-in student or teacher session; the `id` / `school_year` / `content` / `new_password` parameters are concatenated into the query without escaping. Every page can therefore be used as an error-based SQL injection oracle (the raw `mysql_error()` is printed on failure), and the write-capable ones (`update_password.php`, `update_password_student.php`, `edit_post.php`, `read.php`, `read_teacher.php`, `add_student.php`, `add_class_action.php`, `add_subject_overview.php`) additionally allow arbitrary INSERT/UPDATE injection. A low-privileged student account is enough to reach the teacher-only pages' data through UNION-style payloads, and `update_password.php` allows modifying arbitrary rows because the injected `$new_password` is not restricted to the session's own id.

• Source: ⚠️ https://github.com/KusalkaSilva/Learning-Management-System/issues/4
• User: Jameszhan783 (UID 100727)
• Submission: 09/20/2026 17:32 (16 days ago)
• Moderation: 10/06/2026 07:49 (16 days later)
• Status: Accepted
• VulDB entry: 413895 [Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2 search_class.php school_year sql injection]
• Points: 20