Executive brief
Student Crud Operation is a PHP-based student management application available as open-source software. The application contains a time-based blind SQL injection vulnerability in the edit.php file that allows remote attackers to extract sensitive database information by manipulating the ID parameter. This could lead to unauthorized access to student records and database compromise.
Technical details
A time-based blind SQL injection vulnerability exists in the /edit.php file of Student Crud Operation 1.0, triggered by unsanitized user input in the ID parameter. The vulnerable component fails to properly validate or parameterize database queries, allowing an attacker to inject arbitrary SQL commands. The attack can be initiated remotely without authentication by crafting malicious ID values that execute time-delay payloads to infer database structure and exfiltrate data. An attacker can extract sensitive student information, enumerate database contents, or potentially escalate privileges depending on database permissions. No patch information is currently available; remediation requires parameterized queries or input validation.
Affected products
- code-projects Student Crud Operation 1.0
Timeline
- 2026-09-08: disclosed