Executive brief
A vulnerability exists in the Student Membership System, a web application used for managing student records. An attacker can bypass the administrator login screen by entering specially crafted text into the username or password fields. This allows unauthorized access to the administrative dashboard, where an attacker could view, modify, or delete sensitive student data.
Technical details
A SQL injection vulnerability exists in the Admin Login component of code-projects Student Membership System 1.0. The file /admin/index.php fails to sanitize the 'username' and 'password' parameters before concatenating them into a MySQL query. A remote, unauthenticated attacker can exploit this by providing a malicious payload (e.g., ' OR '1'='1) to bypass authentication. Successful exploitation grants full administrative access to the application's backend database and management features. No official patch is currently available; users are advised to implement prepared statements and parameterized queries.
Affected products
- code-projects Student Membership System 1.0
Timeline
- 2026-03-15: disclosed: Initial disclosure on GitHub issue tracker
- 2026-03-31: advisory: NVD and VulDB advisory published