Executive brief
A vulnerability exists in a PHP-based student management system that allows unauthorized individuals to delete critical records. This system is used to manage educational data such as student, teacher, and course information. An attacker can exploit this flaw to remotely delete administrative accounts, student records, or course data, potentially leading to significant data loss and operational disruption.
Technical details
The student_management_system_by_php application contains a critical vulnerability in 'delete.php' due to a combination of missing access controls and improper input sanitization. The script processes several GET parameters (user_id, course_id, teacher_id, student_id, and application_id) and concatenates them directly into SQL DELETE statements without authentication or authorization checks. A remote, unauthenticated attacker can exploit this by sending crafted HTTP GET requests to delete arbitrary records from the database or execute broader SQL injection attacks. The vulnerability is present in versions up to commit 310d950e09013d5133c6b9210aff9444382d16d1; as of the advisory date, no official patch has been released.
Affected products
- raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1
Timeline
- 2026-05-08: disclosed: Issue reported to the project maintainer on GitHub
- 2026-06-01: advisory: CVE published by NVD/VulDB