Executive brief
A vulnerability exists in a PHP-based student management system that allows unauthorized individuals to bypass the login screen. By entering specially crafted text into the username field, an attacker can gain full administrative access to the system without a valid password. This could lead to the theft of sensitive student data, unauthorized modification of records, or a complete shutdown of the management service.
Technical details
A SQL injection vulnerability exists in the `login_check.php` file of the raisulislamg4 student_management_system_by_php project. The application fails to sanitize the 'Username' POST parameter before concatenating it into a SQL query string used for authentication. A remote, unauthenticated attacker can exploit this by providing a malicious payload (e.g., admin' OR '1'='1' -- -) to bypass the password check. Successful exploitation results in the server issuing a valid session cookie for the administrative dashboard, granting the attacker full control over the application's database and functionality. As of the advisory date, no patch has been released by the maintainer.
Affected products
- raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1
Timeline
- 2026-05-08: disclosed: Issue reported to the project maintainer on GitHub
- 2026-06-01: advisory: CVE published by NVD/VulDB