Executive brief
A security vulnerability exists in the CollegeManagementSystem, a platform used by educational institutions to manage student records, staff, and grades. An attacker can exploit this flaw to bypass security controls and directly query the underlying database without needing a username or password. This could lead to the theft of sensitive information, including student records, staff credentials, and academic data, potentially disrupting school operations and compromising student privacy.
Technical details
A SQL injection vulnerability exists in dashboard_page/forms/fetch.php of the tittuvarghese CollegeManagementSystem. The application fails to sanitize or parameterize the 'department_code' POST parameter before embedding it into a MySQL query. Because the endpoint lacks authentication checks, a remote, unauthenticated attacker can use boolean-based or time-based blind SQL injection techniques to extract sensitive data from the database. The vulnerability is present in the rolling release version (specifically identified at commit 3e47633); as of the advisory date, no official patch has been released by the maintainer.
Affected products
- tittuvarghese CollegeManagementSystem commit 3e476335cfbfb9a049e09f474c7ec885f69a9df3
Timeline
- 2026-05-18: disclosed: Issue reported to the maintainer on GitHub
- 2026-06-05: advisory: CVE published to NVD