CVE-2026-10227

Vulnerability

The vulnerability exists in the add_user_check.php file of the student_management_system_by_php project (up to commit 310d950e09013d5133c6b9210aff9444382d16d1). The script does not sanitize the role parameter from $_POST['role'] before inserting it into an SQL query. This allows an attacker to inject arbitrary SQL commands. The affected component is the User Creation Handler. The project follows a rolling release, so no specific version numbers are provided.

Exploitation

An unauthenticated attacker can send a POST request to add_user_check.php with a crafted role parameter. The reference [1] demonstrates that by setting role=admin, the attacker can create a new user with administrative privileges. The SQL injection can be exploited to manipulate the query further, but the primary exploit shown is privilege escalation via direct insertion of the admin role. No authentication or prior access is required.

Impact

Successful exploitation allows an attacker to create arbitrary user accounts with any role, including admin. This results in complete privilege escalation, giving the attacker full administrative control over the application. The attacker can then access all features, modify data, and potentially compromise the entire system.

Mitigation

The project maintainer has not responded to the issue report [1] as of the publication date. No official fix or patched version is available. Users should consider disabling or removing the add_user_check.php file if not needed, or implement proper authentication and input validation. The vulnerability is publicly disclosed and may be exploited.