Executive brief
A security vulnerability exists in the Kushan2k Student Management System, a platform used for managing student records and certificate verification. An attacker can exploit this flaw to bypass security checks and gain unauthorized access to other students' private information, including names, emails, and grades. This could lead to a significant breach of student privacy and potential account takeover.
Technical details
A SQL injection vulnerability exists in the `getStatus` function within `controllers/GradeController.php` (and subsequently `config/User.php`) of the Kushan2k student-management-system. The application fails to properly sanitize or parameterize the `nic` (National Identity Card) argument received via a POST request before using it in a database query. A remote attacker can provide a malicious payload (e.g., '0 OR 1=1 --') to manipulate the query logic, causing the application to return a valid student ID. This ID is then stored in the user's session, effectively allowing the attacker to impersonate other students and access sensitive PII and academic records. As of the advisory date, no official patch has been released by the maintainer.
Affected products
- Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a
Timeline
- 2026-05-20: disclosed: Issue reported on GitHub repository
- 2026-06-08: advisory: CVE published