yashpokharna2555 StudentManagementSystem student_trans.php confirm_logged_in sql injection

Vulnerability

The StudentManagementSystem (commit cb2f558ddf8d19396de0f92abf2d224d46a0a203) contains a SQL injection vulnerability in the student_trans.php file, specifically within the confirm_logged_in function. The issue stems from the direct concatenation of user-supplied POST parameters – FIRST_NAME, Last_Name, and EMAIL – into an INSERT SQL statement without any sanitization or parameterized queries [1]. The project uses a rolling release model, so no specific version numbers are provided for affected or fixed releases [2].

Exploitation

The attacker requires no authentication as the script does not include session.php nor calls confirm_logged_in(), meaning the endpoint is completely exposed [1]. The attack can be launched remotely by sending a crafted POST request directly to http://127.0.0.1:8000/student_trans.php?action=add with malicious values in the FIRST_NAME, Last_Name, or EMAIL parameters. Public exploit code has been disclosed [2].

Impact

Successful exploitation allows an attacker to perform arbitrary SQL queries, such as inserting malicious XSS payloads into the database or conducting time‑based/error‑based SQL injection. This can lead to unauthorized data manipulation, data exfiltration, and potentially full database compromise, depending on the database user's privileges [1].

Mitigation

The project maintainer has been notified via a GitHub issue [1] but has not responded. No official fix or patched release has been published. As a workaround, developers should implement proper authentication checks (including session.php and confirm_logged_in()) and convert all database queries to parameterized prepared statements [1]. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing.