CVE-2026-5197

Root

Cause The vulnerability is a classic SQL injection flaw in /delete_user.php of the code-projects Student Membership System 1.0. The code directly concatenates the $_POST['id'] parameter into a DELETE statement without any sanitization or prepared statements: mysql_query("delete from user where user='$id'") [1].

Exploitation

An attacker can remotely exploit this by sending a crafted POST request with a malicious id value. No authentication is required, and the attack complexity is low. The exploit has been publicly released, lowering the barrier for attackers [1].

Impact

Successful exploitation allows an attacker to delete arbitrary user records, including all administrator accounts, potentially rendering the system unmanageable. The attacker could delete the entire user table, causing a denial of service and complete loss of system administrative control [1].

Mitigation

As of the publication date, the vendor has not released a patch. The project's homepage [2] may offer updates. The recommended fix is to use prepared statements with PDO or MySQLi and to perform strict input validation. Until a fix is applied, administrators should restrict network access to the vulnerable endpoint.