Executive brief
Student Management System is a school administration tool used to track student records, grades, and teacher information. The application contains SQL injection vulnerabilities in its core data management functions, allowing remote attackers to modify or delete arbitrary student, teacher, and grade records, potentially corrupting critical educational data and compromising account credentials.
Technical details
The vulnerability is a classic SQL injection affecting the Management Mutation Handler component in add/edit/delete operations (add_student.php, add_teacher.php, add_result.php, admin_edit_student.php, admin_edit_teacher.php, admin_edit_result.php, delete_student.php, delete_teacher.php, delete_result.php). POST parameters including roll_no, name, father_name, class, mobile, email, password, and remark are directly embedded into SQL queries without parameterization or type casting. An unauthenticated attacker can craft POST requests with SQL predicates in parameters like "roll_no=1 OR 1=1" to modify all records instead of a single target, or use DELETE predicates to destroy data. The attack requires network access and does not mandate prior authentication; a published exploit exists and the vendor has not yet responded to the security report.
Affected products
- sambitraj Student Management System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5
Timeline
- 2026-08-23: disclosed: CVE-2026-78057 published on NVD
- 2026-07-06: other: Vulnerability reported via GitHub issue #5; vendor has not responded