Executive brief
The Student Management System contains hard-coded database credentials in its configuration file that are exposed in the repository. When deployed with default settings, these credentials allow anyone with access to the source code or the publicly reachable Adminer database interface to gain full administrative access to the database, potentially exposing student personal information, password hashes, and enabling unauthorized modification of grades and enrollment records.
Technical details
A hard-coded credential vulnerability exists in config/database.php where database connection parameters (username "hw", password "hwhwhw") are committed to the repository in plaintext. The system also includes a publicly reachable Adminer database management interface at /config/adminer.php that can be accessed remotely without authentication over the network. An attacker with repository access or who discovers the web-accessible Adminer interface can use the hard-coded credentials to authenticate and gain full administrative access to the database. This allows unauthorized access to sensitive student PII, password hashes, and the ability to modify grades, enrollment data, and account records. The project uses a rolling release model and has not yet responded to the vulnerability report.
Affected products
- ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf
Timeline
- 2026-09-08: disclosed: Public disclosure via NVD
- 2026-07-29: other: Issue reported to project