Executive brief
Student Management System is a school administration application used to track student grades and manage school data. The system ships with a database file containing a default administrator account using a public, hard-coded password (admin123). An attacker can gain full administrator access to any deployment that imports the bundled database without changing this password, enabling manipulation of student records, grades, and teacher information.
Technical details
The vulnerability is a use of default password weakness in the bundled aca.sql database initialization file. The affected component is the default database schema, which hardcodes a privileged administrator account (email: admin123@gmail.com, password: admin123) that is created when the SQL dump is imported. The attack vector is network-based, requiring only knowledge of the public default credentials and network access to the deployed application; no authentication bypass is needed since the credentials are valid. An attacker can authenticate as administrator via the admin_login.php endpoint and gain access to all administrative functions including student, teacher, and grade management. The project has not responded to fix the issue, and there is no forced password change mechanism on first login to mitigate the exposure.
Affected products
- sambitraj Student-Management-System up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5
Timeline
- 2026-08-31: disclosed: CVE-2026-82698 published on NVD
- 2026-07-17: advisory: Issue reported to GitHub repository