CVE-2025-12277
Description
A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentLogin.php. This manipulation of the argument Email causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An SQL injection vulnerability in Online-School's /studentLogin.php allows remote attackers to manipulate the Email parameter for unauthorized database access.
Vulnerability
An SQL injection flaw exists in the Abdullah-Hasan-Sajjad Online-School application, up to commit f09dda77b4c29aa083ff57f4b1eb991b98b68883. The issue is located in the /studentLogin.php file, where the Email argument is improperly sanitized before being used in database queries [1]. This lack of input validation allows an attacker to inject arbitrary SQL commands.
Exploitation
The attack can be carried out remotely without requiring prior authentication [1]. The exploitation of this vulnerability has been publicly published, meaning proof-of-concept code is available, which lowers the barrier for malicious actors to exploit affected instances.
Impact
Successful exploitation could allow an attacker to read, modify, or delete sensitive data from the application's database, potentially including user credentials, personal information, and other application data [1]. The CVSS v3 score of 7.3 (High) reflects the serious confidentiality, integrity, and availability risks.
Mitigation
The vendor was contacted about this disclosure but did not respond. The product uses a rolling release strategy, but no patch has been confirmed. Users should consider restricting network access to the affected endpoint or applying external input validation until a fix is released [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.