Executive brief
PHPGurukul Student Information System is a free educational management platform used to store student records and account information. An authenticated attacker can inject malicious SQL commands into user input fields to manipulate the database, steal sensitive student data, modify records, or potentially gain full system control.
Technical details
A SQL injection vulnerability exists in the Student Information System's /student_edit1.php and /change-password.php endpoints where the "id" parameter is not properly validated or escaped before use in SQL queries. The vulnerability requires authentication; an attacker must log in with valid credentials before exploiting it. An unauthenticated remote attacker can bypass authentication or an authenticated user can manipulate the "id" parameter with SQL commands (e.g., using RLIKE CASE constructs for blind SQL injection) to access unauthorized data, modify records, or execute arbitrary database operations. No patch information is currently available in the advisory; remediation involves implementing parameterized queries (prepared statements) and strict input validation.
Affected products
- PHPGurukul Student Information System 1.0
Timeline
- 2026-07-13: disclosed: Vulnerability reported on GitHub
- 2026-08-29: advisory: CVE-2026-82424 published