CVE-2026-11476

Vulnerability

A vulnerability exists in the edit-admin function within controllers/AdminController.php of the Kushan2k student-management-system up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. The endpoint lacks a session check for administrator privileges, allowing any unauthenticated visitor to trigger the profile update logic. The affected component is the Profile Update Endpoint.

Exploitation

An attacker can exploit this vulnerability by sending an unauthenticated POST request to the AdminController.php with the edit-admin action. The attacker needs network access to the target system and can manipulate the isadmin argument, or other parameters like id or email, to target specific administrator accounts. The vulnerability is present in the edit-admin action, and the underlying database operations in config/User.php use SQL concatenation, making it susceptible to SQL injection.

Impact

Successful exploitation allows an attacker to modify any administrator's email address, which can lead to account takeover via password reset mechanisms, or change an administrator's password, effectively locking them out. The SQL injection vulnerability also presents a risk of reading or modifying other sensitive data within the database, depending on the attacker's skill and the database schema.

Mitigation

This product follows a rolling release approach, and specific version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report [1] but has not yet responded with a patch or fix. As of the available references, no fixed version or workaround has been disclosed.