Executive brief
The School Management System is a PHP-based web application used to manage school operations including student and staff authentication. An attacker can exploit a SQL injection vulnerability in the login form by sending a specially crafted email parameter, allowing unauthorized database access and potential exposure of user credentials and school data without requiring authentication or special privileges.
Technical details
The vulnerability is a classic SQL injection flaw in the User_Login.php file where the email parameter submitted via POST request is directly concatenated into a SQL query without filtering or parameterized queries. The attack vector is network-based and unauthenticated—an attacker can send a malicious email value (e.g., `1'||(SELECT...))||'`) to the login endpoint at /school/model/user_login.php to execute arbitrary SQL commands. An attacker can enumerate the database schema, extract sensitive data such as user credentials, or modify database records. The vulnerability affects version 1.0 of the product; patch status is unknown but the exploit code is publicly available.
Affected products
- itsourcecode School Management System 1.0
Timeline
- 2026-07-23: disclosed
- 2026-09-07: advisory