Executive brief
The Scholars Tracking System is a web-based application for managing student records and administrative tasks. An unauthenticated attacker can exploit SQL injection flaws in the admin user management endpoints to extract all usernames and passwords from the database, modify or insert arbitrary records, or deny service. No authentication is required—attackers can attack directly from the internet without valid credentials.
Technical details
The vulnerability is a combination of missing authentication (CWE-306) and SQL injection (CWE-89) in the /admin/save_user.php and /admin/update_user.php endpoints. These endpoints directly concatenate unsanitized POST parameters (firstname, lastname, username, password, user_id) into SQL INSERT and UPDATE statements without validation or prepared statements. An attacker sends a crafted HTTP POST request with SQL metacharacters (such as single quotes and UNION/SELECT clauses) in the POST body to break out of the SQL string context and inject arbitrary SQL commands. The attack is network-reachable and requires no prior authentication or user interaction. A successful exploit permits full database disclosure, arbitrary data modification, and potential denial of service.
Affected products
- code-projects Community Project Scholars Tracking System 1.0
Timeline
- 2026-02-18: disclosed: CVE-2025-70152 published