yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection

Vulnerability

The vulnerability resides in the confirm_logged_in function within /studentdel.php of the yashpokharna2555/StudentManagementSystem project [1]. The $_GET['id'] parameter is directly concatenated into a DELETE SQL query without sanitization or parameterization, leading to SQL injection [2]. The affected code path is present in all versions up to commit cb2f558ddf8d19396de0f92abf2d224d46a0a203; the project operates on a rolling release basis with no explicit version numbers [1].

Exploitation

An attacker can exploit this vulnerability remotely without any authentication or prior knowledge [2]. The attack requires only a crafted GET request to studentdel.php with a malicious id parameter. For example, sending id=9999%20OR%201=1 causes the application to execute DELETE FROM ... WHERE id = 9999 OR 1=1, deleting every student record [2]. No cookies or session tokens are needed, and the attacker does not need to be logged in [2].

Impact

Successful exploitation results in complete deletion of all student records from the database, leading to total data loss and denial of service [2]. The application becomes unusable until the data is restored. An attacker could also selectively delete records to disrupt operations [2]. No privilege escalation is required; the action is performed as an unauthenticated user [2].

Mitigation

As of the publication date, no official fix has been released. The project maintainer was informed via an issue report but has not responded [2]. The only mitigation is to manually implement authentication checks (e.g., include session.php and call confirm_logged_in()) and use prepared statements or parameterized queries for the id parameter [2]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.