Executive brief
Soarkey StudentManagement is a Java-based student information management system used by educational institutions to track student records, courses, and grades. A SQL injection vulnerability in the course ranking feature allows attackers to bypass authentication requirements, extract sensitive data (including admin credentials), and modify database queries by manipulating the course number parameter. This could lead to unauthorized access to student records and system compromise.
Technical details
The vulnerability is a SQL injection flaw in the `course_ranking` method of `CourseDao.java`, where user-supplied input from the `cno` (course number) parameter is concatenated directly into a SQL query string. Although the code uses `PreparedStatement`, it defeats parameterization by embedding the unsanitized input before statement preparation. An unauthenticated remote attacker can exploit this via HTTP GET/POST requests to the `/AdminDao` endpoint, using boolean-based or UNION-based injection techniques to enumerate tables and extract arbitrary data (e.g., usernames, passwords). The vulnerable code is exposed in commit `e08f7f1d5015af407aa4cca0ada3dea189b4937e` and public proof-of-concept exploits exist. No patch has been released as the maintainers have not responded to the issue report.
Affected products
- Soarkey StudentManagement up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e
Timeline
- 2026-08-31: disclosed: CVE-2026-82620 published on NVD
- 2026-08-31: other: Public exploit proof-of-concept released