CVE-2026-7229

Vulnerability

Overview

A SQL injection vulnerability exists in the Coaching Management System by code-projects.org. The flaw resides in the file /cims/modules/admin/reply.php, where the complaintreply parameter is not properly sanitized before being used in SQL queries. This allows an authenticated attacker to inject arbitrary SQL commands [1].

Exploitation

An attacker must first authenticate as an administrator. Once logged in, they can send a POST request to the reply endpoint with a malicious payload in the complaintreply parameter. The proof of concept demonstrates injection using a simple ' OR 1=1-- - payload, and automated tools like sqlmap can be used to exploit the vulnerability remotely [1].

Impact

Successful exploitation leads to full database extraction, including user credentials stored in plaintext, student personally identifiable information (PII), teacher records, and complaint history. This can result in complete compromise of application data and potential privilege escalation [1].

Mitigation

As of the publication date, no official patch has been released by the vendor. The source code is available on the code-projects.org website, but no fix has been provided [2]. Users should consider implementing input validation and parameterized queries to mitigate the risk.