Executive brief
The Student Admission System, a web application for managing school enrollments, contains a security vulnerability that allows unauthorized access to its database. By sending specially crafted web requests, an attacker can view, modify, or delete sensitive student information without needing a username or password. This could lead to data theft, loss of data integrity, or disruption of the admission process.
Technical details
A SQL injection vulnerability exists in code-projects Student Admission System 1.0 within the /index.php file. The root cause is the improper neutralization of special elements in the 'eid' and 'did' GET parameters, which are used directly in SQL queries without sufficient validation or prepared statements. A remote, unauthenticated attacker can exploit this by sending crafted HTTP requests to perform boolean-based blind, error-based, time-based blind, or UNION-based SQL injection. Successful exploitation allows for unauthorized database access, sensitive data exfiltration, and potential modification of records. Public exploits (PoCs) using tools like sqlmap have been disclosed.
Affected products
- code-projects Student Admission System 1.0
Timeline
- 2026-05-14: disclosed: Vulnerability details and PoC shared on GitHub by researcher Xu Zhihan.
- 2026-06-02: advisory: NVD and VulDB published the advisory.