CVE-2026-10225: SQL Injection in PHP Student Management System Login

Technical summary

CVE-2026-10225 is a SQL injection flaw (CWE-89, CWE-74) in the login component of a PHP student management system. The vulnerability exists in login_check.php where insufficient input validation on the Username parameter allows an attacker to craft SQL injection payloads. The attack vector is network-based (AV:N), has low attack complexity (AC:L), requires no privileges (PR:N) or user interaction (UI:N), and operates in the changed scope context with partial impact on confidentiality, integrity, and availability (C:L/I:L/A:L).

Business impact

Unauthorized database access could expose sensitive student records, administrative credentials, and personal information. An attacker could modify grades, enroll/remove students, or corrupt attendance records. The confidentiality breach exposes educational records; the integrity impact enables data manipulation; potential availability issues could disrupt system operations during an active attack or data exfiltration.

Affected systems

The student management system (raisulislamg4/student_management_system_by_php) up to commit 310d950e09013d5133c6b9210aff9444382d16d1 is affected. Because the project uses a rolling release model, specific version numbers are not available. Any deployment of this system without patches beyond the identified commit is vulnerable. Educational institutions running this open-source system are the primary targets.

Exploitability

This vulnerability is highly exploitable. No authentication is required to reach the login_check.php endpoint, attack complexity is low, and the exploit is publicly available. Remote exploitation over the network is straightforward—an attacker can craft malicious SQL through the Username field without special access or user interaction. The public availability of exploit code significantly increases the practical risk.

Remediation

The project has been notified but has not yet responded with a patch. Organizations should: (1) monitor the project repository for security commits beyond the vulnerable commit hash, (2) implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the Username parameter, (3) consider a security code review and patch in-house if timely upstream fixes are not forthcoming, and (4) restrict network access to the login_check.php endpoint to authorized IP ranges if operationally feasible.

Patch guidance

No official patch version is currently available due to the rolling release model and lack of upstream response. Verify the project repository for any security-related commits after commit 310d950e09013d5133c6b9210aff9444382d16d1. In the interim, apply input validation and parameterized queries locally if you maintain a fork, or restrict access via network controls. Monitor the project's GitHub issues and commit history for security updates.

Detection guidance

Monitor authentication logs for unusual SQL syntax patterns in Username fields (e.g., quotes, SQL keywords, comment sequences). Deploy WAF signatures targeting common SQL injection payloads. Log and alert on failed login attempts with special characters or multi-statement queries. Network-based detection should flag requests to login_check.php containing UNION, SELECT, OR, DROP, or other SQL keywords in the Username parameter.

Why prioritize this

HIGH severity due to (1) unauthenticated network-accessible SQL injection, (2) public exploit availability accelerating real-world attack risk, (3) sensitive data exposure (student records, grades, personal information), (4) integrity compromise enabling unauthorized modifications, (5) lack of upstream patch response necessitating urgent defensive measures, and (6) low attack complexity reducing attacker skill requirements.

Risk score, explained

CVSS 3.1 score of 7.3 (HIGH) reflects unauthenticated remote exploitation (AV:N/PR:N/UI:N) with low complexity (AC:L). The unchanged scope (S:U) and partial impact on confidentiality, integrity, and availability (C:L/I:L/A:L) justify the elevated rating. Public exploit availability and lack of vendor response push this from a medium concern to an urgent remediation priority.

Frequently asked questions