yashpokharna2555 StudentManagementSystem success.php sql injection

Vulnerability

A SQL injection vulnerability exists in success.php of yashpokharna2555's StudentManagementSystem (rolling release, commit cb2f558d). The $_POST['user'] parameter is directly concatenated into a SQL query without sanitization or parameterization, affecting the admin table authentication logic [1][2]. The code path is reachable by any visitor to the application's login endpoint.

Exploitation

An attacker can achieve authentication bypass by sending a crafted POST request to /success.php with the user parameter containing a SQL comment sequence (e.g., admin@admin.com' #). No prior authentication, special network position, or user interaction is required. The request is trivially crafted using tools such as curl [2]. The server responds with a redirect to index.php, confirming a successful authenticated session without the correct password.

Impact

Successful exploitation allows an attacker to impersonate any user stored in the admin table — including the administrator — without knowing their password. The attacker gains full access to the Student Management System's administrative interface, which can lead to complete confidentiality, integrity, and availability compromise of student records and system configuration [1][2].

Mitigation

As of the publication date (2026-05-25), no patched version is available; the project uses a rolling release model and has not responded to the vulnerability report [1]. The only workaround is to implement prepared statements or input sanitization in success.php manually, or discontinue use of the software until a fix is released [2].