CVE-2026-10620
Description
A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown function of the file /index.php. This manipulation of the argument eid/did causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Affected products
1- Range: =1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Insufficient user input validation of the 'eid' and 'did' parameters in /index.php allows for SQL injection."
Attack vector
An attacker can remotely exploit this vulnerability by sending crafted GET requests to the /index.php file. The manipulation occurs through the 'eid' or 'did' parameters, which are directly incorporated into SQL queries without proper sanitization [ref_id=1, ref_id=2]. This allows attackers to inject malicious SQL code, leading to unauthorized database access and data manipulation [ref_id=1, ref_id=2]. No login or authorization is required to perform this attack [ref_id=1, ref_id=2].
Affected code
The vulnerability resides in the /index.php file of the Student Admission System version 1.0 [ref_id=1, ref_id=2]. Specifically, the 'eid' and 'did' parameters are vulnerable to SQL injection due to a lack of input validation [ref_id=1, ref_id=2].
What the fix does
The advisory suggests using prepared statements and parameter binding to prevent SQL injection by treating user input as data rather than executable code [ref_id=1, ref_id=2]. Additionally, strict input validation and filtering are recommended to ensure user-supplied data conforms to expected formats [ref_id=1, ref_id=2]. Minimizing database user permissions and conducting regular security audits are also advised as preventative measures [ref_id=1, ref_id=2]. A specific patch is not provided in the bundle.
Preconditions
- networkThe attacker must be able to send network requests to the target system.
- inputThe attacker must be able to control the 'eid' or 'did' GET parameters.
- authNo authentication or authorization is required to exploit this vulnerability.
Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
8News mentions
0No linked articles in our index yet.