VYPR
← All advisories
Medium severity6.3NVD Advisory· Published Jun 8, 2026

CVE-2026-11475

CVE-2026-11475

Description

SQL injection in Kushan2k student-management-system allows remote attackers to access student data by manipulating the 'nic' parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

SQL injection in Kushan2k student-management-system allows remote attackers to access student data by manipulating the 'nic' parameter.

Vulnerability

A SQL injection vulnerability exists in the getStatus function within controllers/GradeController.php of the Kushan2k student-management-system, up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. The vulnerability is triggered when the nic parameter is processed without proper sanitization or parameterization, allowing malicious SQL queries to be embedded.

Exploitation

An attacker can exploit this vulnerability remotely by sending a POST request to controllers/GradeController.php with a manipulated nic parameter containing a SQL injection payload, such as 0 OR 1=1 --. This payload alters the SQL query to return the first student ID, bypassing the intended certificate verification.

Impact

Successful exploitation allows an attacker to bypass certificate verification and gain access to a student's session, enabling them to view sensitive personal information, enrolled courses, and other data associated with that student's account. This can lead to unauthorized information disclosure and potential privilege escalation.

Mitigation

This product operates on a rolling release basis, and specific version details for affected or updated releases are not available. The project was notified of the issue early via an issue report [1], but no official response or patch has been released. There are no disclosed workarounds or fixed versions at this time.

References
  1. SQL Injection in Certificate Verification Leading to Arbitrary User Information Disclosure and Privilege Escalation

AI Insight generated on Jun 8, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"The getStatus function in GradeController.php embeds user input directly into an SQL query without sanitization or parameterization."

Attack vector

An attacker can remotely send a POST request to the Certificate Verification Endpoint with a manipulated 'nic' argument. This argument is passed to the getStatus method, which then directly embeds it into an SQL query. By injecting a boolean-based payload, such as '0 OR 1=1 --', an attacker can alter the query's logic. This allows them to bypass the intended verification and obtain the session ID of another user, leading to unauthorized access.

Affected code

The vulnerability resides in the getStatus function within the file controllers/GradeController.php and the subsequent use in config/User.php. Specifically, the line `$res = $this->db->query("... WHERE student.NIC={$index} OR student.student_id='{$index}' OR registrations.cetificate_no='{$index}'");` in config/User.php directly embeds the user-supplied `$index` (derived from the 'nic' POST parameter) into the SQL query without any form of sanitization or parameterization.

What the fix does

The advisory indicates that the project was informed of the vulnerability but has not responded, and no patch is available. Remediation guidance would typically involve parameterizing SQL queries or properly escaping user input before embedding it in database queries to prevent SQL injection.

Preconditions

  • inputThe attacker must provide a value for the 'nic' POST parameter.
  • authThe attacker does not need to be authenticated to exploit this vulnerability.
  • networkThe attack can be launched remotely over the network.

Reproduction

Without a valid certificate number, send a POST request to GradeController.php with a malicious nic payload. Observe the server responds with a 302 Found redirect to mycourse.view.php. Follow the redirect with the same session cookie. The page displays another student’s personal details, email, NIC, and course information, confirming unauthorised access.

Generated on Jun 8, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.