Executive brief
A vulnerability exists in the Faculty Management System, a software used to manage academic staff and departmental records. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or tampering with records. This attack can be performed remotely without requiring any login credentials.
Technical details
A SQL injection vulnerability exists in the '/subject-print.php' file of code-projects Faculty Management System 1.0. The root cause is the improper neutralization of the 'id' GET parameter before it is used in a SQL query. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests containing boolean-based, time-based, or UNION-based SQL payloads. Successful exploitation allows for unauthorized database access, data exfiltration, and potential modification of system records. A public exploit (PoC) has been disclosed.
Affected products
- code-projects Faculty Management System 1.0
Timeline
- 2026-04-04: disclosed: Initial disclosure on GitHub issue tracker
- 2026-04-13: advisory: CVE-2026-6167 published