CVE-2026-10226

Vulnerability

The delete.php file in raisulislamg4's student_management_system_by_php (up to commit 310d950e09013d5133c6b9210aff9444382d16d1) contains a SQL injection vulnerability. The script accepts user_id, course_id, teacher_id, student_id, and application_id parameters via GET requests and directly concatenates them into SQL DELETE queries without sanitization or parameterization [1][2]. The product operates on a rolling release, so no specific version numbers are available.

Exploitation

An attacker can exploit this vulnerability remotely without any authentication. By sending a crafted GET request to delete.php with a malicious value in any of the listed parameters, the attacker can inject arbitrary SQL commands. The issue report provides a proof-of-concept using user_id=1 to delete an administrator account [2]. No user interaction or special privileges are required.

Impact

Successful exploitation allows an unauthenticated attacker to delete arbitrary records from the database, including users, courses, teachers, students, and applications. This can lead to data loss, denial of service, and potential privilege escalation if administrative accounts are removed. The SQL injection may also be leveraged to extract or modify other data depending on the database configuration.

Mitigation

As of the publication date, no fix has been released. The project maintainer was notified via an issue report but has not responded [2]. Users should consider disabling or removing delete.php until a patch is available, or implement proper authentication and input validation. The product is on a rolling release, so updates may appear at any time.