Executive brief
Stud.IP is a learning management system widely deployed at German universities for course administration and student grade management. A SQL injection vulnerability in the course admission system allows authenticated users with lecturer or admin privileges to extract the entire database (including student grades, password hashes, and private messages) or cause a denial-of-service attack against the system.
Technical details
Multiple SQL injection vulnerabilities exist in Stud.IP's course admission system (CVE-2026-51346) across four PHP classes: CourseSet, AdmissionUserList, ConditionalAdmission, and UserFilter. These classes concatenate user-controlled input directly into SQL queries via string interpolation instead of using parameterized queries, particularly in their store() methods. An authenticated attacker with dozent (lecturer) or admin privileges can exploit these injection points to extract sensitive data or perform denial-of-service attacks. The vulnerabilities were patched in versions 6.0.3 and 5.4.12 released on April 22, 2026; all prior versions are affected.
Affected products
- Stud.IP Stud.IP 6.0.x before 6.0.3, 5.4.x before 5.4.12
Timeline
- 2026-08-17: disclosed: Public disclosure via blog post and NVD
- 2026-04-22: patched: Patches released: v6.0.3 and v5.4.12
- 2026-04-12: other: Vulnerabilities discovered
- 2026-04-13: other: Vulnerabilities reported to Stud.IP
- 2026-04-21: other: Stud.IP confirmed vulnerabilities