CVE-2026-6488

Vulnerability

Details

A SQL injection vulnerability exists in the QueryMine sms application up to commit 7ab5a9ea196209611134525ffc18de25c57d9593. The issue is present in the file admin/editcourse.php within the GET request parameter handler. The "ID" parameter is not properly sanitized before being used in SQL queries, allowing an attacker to inject arbitrary SQL commands. The project is a PHP-based student management system (SMS) that uses a MySQL database [1].

Exploitation

The vulnerability can be exploited remotely by sending a crafted HTTP GET request to the admin/editcourse.php endpoint with a malicious ID parameter. No authentication is explicitly required, but the endpoint is part of the admin panel, so access to this page may require prior authentication. However, the attack vector is remote, and the exploit has been publicly disclosed, increasing the risk of active exploitation.

Impact

Successful exploitation allows an attacker to perform SQL injection attacks, which can lead to unauthorized access to the database, data exfiltration, modification or deletion of records, and potentially full compromise of the application. Given the database may contain sensitive student information, the impact could be significant.

Mitigation

The vendor was contacted early but did not respond. As the product uses continuous delivery with rolling releases, no specific version details are available. Users are advised to apply the latest updates if available, or consider implementing input validation and parameterized queries to mitigate the risk until an official fix is released.