CVE-2026-10110: SQL Injection in code-projects Student Details Management System 1.0

Technical summary

CVE-2026-10110 is a SQL injection vulnerability (CWE-89) triggered via unsafe handling of the 'roll' parameter in /index.php of the Student Details Management System. The vulnerability stems from improper input validation and neutralization (CWE-74), allowing attackers to craft malicious SQL queries. The CVSS 3.1 score of 7.3 (HIGH severity) reflects the network-accessible nature (AV:N), low attack complexity (AC:L), absence of privilege requirements (PR:N), and the combined impact on confidentiality, integrity, and availability (C:L/I:L/A:L). The lack of user interaction (UI:N) and unchanged scope (S:U) indicate a straightforward exploitation path.

Business impact

Organizations deploying this system face significant operational and reputational risk. Attackers can exfiltrate sensitive student data including personally identifiable information (PII), potentially triggering data protection compliance violations and privacy breaches. Malicious modification of student records could corrupt institutional data integrity, disrupt academic operations, and erode stakeholder trust. In educational settings handling minors, breaches carry heightened regulatory scrutiny under laws such as FERPA in the United States.

Affected systems

The vulnerability affects code-projects Student Details Management System version 1.0. Organizations running this application—particularly educational institutions, training centers, and administrative bodies managing student records—should immediately identify and audit affected deployments. The vendor information was not disclosed in available advisories; administrators should verify the exact product lineage and installed versions within their infrastructure.

Exploitability

Exploitation is feasible and likely underway. The attack requires no authentication, low technical skill to execute, and can be performed remotely via HTTP. The public availability of working exploit code significantly lowers the barrier to entry for opportunistic attackers. The straightforward nature of SQL injection in a parameter-based input vector means exploitation can be achieved through basic fuzzing or publicly available payloads without sophisticated tooling.

Remediation

Immediate remediation is essential given the public exploit availability and HIGH severity rating. Organizations should prioritize upgrading to a patched version as provided by code-projects; verify the specific patch version number against the vendor's security advisory. If upgrades cannot be immediately deployed, implement compensating controls: deploy a Web Application Firewall (WAF) with SQL injection detection rules, restrict network access to the application via firewall policies, and apply input validation and parameterized query enforcement at the application layer. Monitor access logs and database activity for signs of exploitation.

Patch guidance

Contact code-projects for the latest patched version of Student Details Management System addressing this vulnerability. Apply patches in a non-production environment first to validate compatibility and functionality. Given the public exploit, treat this as a priority-one patch regardless of normal change management windows. Verify the patch version number against the vendor advisory before deployment to ensure you are receiving an authentic, complete fix. After patching, conduct database integrity checks to detect any unauthorized modifications that may have occurred during the vulnerability window.

Detection guidance

Monitor web server access logs for suspicious patterns in the /index.php endpoint, particularly requests containing SQL keywords (SELECT, UNION, INSERT, DROP) in the 'roll' parameter or URL-encoded variants thereof. Deploy or configure your WAF to alert on known SQL injection payloads and suspicious SQL syntax in HTTP parameters. Review database query logs and audit trails for unexpected or anomalous queries originating from the application layer. Use intrusion detection systems (IDS) to flag inbound traffic matching SQL injection signatures. Establish baseline traffic patterns pre-patch to identify anomalies post-exploitation. Additionally, monitor student record databases for unauthorized access, deletions, or modifications, particularly on timestamp and change-tracking fields.

Why prioritize this

This vulnerability merits immediate attention due to the combination of HIGH CVSS severity, public exploit availability, zero authentication requirements, and remote network accessibility. The sensitivity of educational data, regulatory compliance implications (FERPA, GDPR, state privacy laws), and operational disruption potential make this a critical risk. The absence of compensating controls in typical deployments and the ease of exploitation compound urgency. Organizations should treat this as a priority-one incident response item.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects a critical threat profile: Network-accessible (AV:N) with no authentication barrier (PR:N), the attack complexity is minimal (AC:L), no user interaction is required (UI:N), and the impact spans confidentiality, integrity, and availability across the security scope (C:L/I:L/A:L). While the impact ratings are 'Low' individually, the cumulative effect—combined with ease of exploitation and public exploits—justifies the HIGH severity classification and the urgent remediation posture recommended.

Frequently asked questions