Executive brief
StudentManage, a web-based student information management system, contains a security flaw that allows authenticated users to interfere with its database. By exploiting this vulnerability, an attacker could gain unauthorized access to sensitive student records, modify academic data, or potentially delete information. This could lead to significant data breaches and loss of integrity for educational records.
Technical details
A SQL injection vulnerability exists in DayCloud StudentManage v1.0 within the 'query' parameter of the /admin/adminStudentUrl endpoint. The flaw is located in the com.dayrain.controller.admin.AdminStudentController class, where user-supplied input for the student search function is not properly sanitized or parameterized before being used in a database query. An attacker with low-level administrative privileges can exploit this via the network to extract sensitive data, modify database contents, or bypass authentication mechanisms. The vulnerability has been verified using manual injection payloads and automated tools like SQLMap.
Affected products
- DayCloud StudentManage 1.0
Timeline
- 2025-07-18: disclosed: Vulnerability reported on GitHub issues and published to NVD
- 2025-07-21: advisory: CISA-ADP enrichment added CVSS and CWE data