CVE-2026-10111

Vulnerability

A SQL injection vulnerability exists in sambitraj STUDENT-MANAGEMENT-SYSTEM version 1.0. The login endpoints (admin_login.php, student_login.php, teacher_login.php) directly embed the user-supplied email parameter into a SQL query without sanitization or parameterization (e.g., $query = "select * from admin where email = '$_POST[email]'"). This makes the application vulnerable to time-based blind SQL injection, as detailed in the issue report [2]. No authentication is required to reach these endpoints.

Exploitation

An attacker can exploit this vulnerability remotely by sending a POST request to any of the login endpoints with a malicious email value containing a SQL time-delay function such as SLEEP(). Because the query result is not reflected in the response, the attacker must use a time-based blind technique: send a payload that causes a database delay, measure the response time, and infer database contents by comparing delays across multiple requests [2]. Steps include crafting payloads like ' OR SLEEP(5)-- - in the email field and observing the response latency.

Impact

Successful exploitation allows an attacker to extract sensitive data from the database, including user credentials and other stored information. Although the vulnerability does not directly allow authentication bypass or data modification, time-based blind SQL injection enables full database enumeration. An attacker could obtain admin credentials and escalate privileges, leading to complete compromise of the application's data confidentiality [2].

Mitigation

No official patch has been released by the vendor; the project maintainer was informed via an issue report but has not responded (as of May 2026). Users must implement a workaround by replacing the vulnerable dynamic SQL queries with prepared statements or parameterized queries. If immediate code changes are not possible, restricting network access to the login pages may reduce exposure. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at this time.