CVE-2026-10225

Vulnerability

The vulnerability resides in the login_check.php file of the raisulislamg4/student_management_system_by_php project, up to commit 310d950e09013d5133c6b9210aff9444382d16d1. The login script directly concatenates the user-supplied username POST parameter and the MD5 hash of the password into an SQL query without any parameterization, escaping, or input validation. The affected code constructs SELECT * FROM USERS WHERE USERNAME='$name' AND PASSWORD='$pass', making it susceptible to SQL injection [1]. The project uses a rolling release model, so no specific version numbers are available [2].

Exploitation

An attacker can exploit this vulnerability remotely by sending a crafted POST request to login_check.php. The attack requires no prior authentication. By injecting a classic SQL payload into the username field, such as admin' OR '1'='1' -- -, and providing any password, the query becomes SELECT * FROM USERS WHERE USERNAME='admin' OR '1'='1' -- -' AND PASSWORD='...', which bypasses the password check. The server responds with a 302 Found redirect to admin_home.php and sets a valid session cookie. The attacker can then use that session cookie to access the admin dashboard directly, confirming successful authentication bypass [1].

Impact

Successful exploitation results in authentication bypass, granting the attacker an administrative session without valid credentials. Once authenticated as an admin, the attacker gains full control over the application, including the ability to add, edit, or delete records, access sensitive data, and potentially chain with other vulnerabilities (e.g., stored XSS) to further compromise the system [1].

Mitigation

As of the publication date, no fix has been released. The project maintainer was informed via an issue report but has not responded [1]. The only mitigation is to apply input validation and use parameterized queries (prepared statements) in login_check.php. Since the project is unmaintained, users should consider migrating to an alternative solution or implementing a custom patch. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [2].