CVE-2026-11475: SQL Injection in Kushan2k Student Management Certificate Verification

Technical summary

The vulnerability exists in controllers/GradeController.php within the getStatus function of the Certificate Verification Endpoint. The 'nic' parameter is not properly sanitized before being used in SQL queries, allowing authenticated users to execute arbitrary SQL through CWE-89 (SQL Injection) via CWE-74 (Improper Neutralization of Special Elements in Output). The affected commit hash is f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. The project operates on a rolling release model without discrete version numbers, complicating patch tracking.

Business impact

Organizations running this student management system face confidentiality, integrity, and availability risks. Attackers with valid credentials can extract sensitive student data (grades, personal identifiers, certificates), modify academic records, or degrade system availability. Educational institutions relying on this for certificate issuance face operational disruption and potential reputational damage from data breaches or fraudulent certificate generation.

Affected systems

Kushan2k student-management-system up to commit f16a4ceaddd6729c4b306ed4641cda3176c1ef2a is affected. The rolling-release development model means no discrete version numbering is used. Any deployment incorporating the vulnerable commit or earlier is at risk. Organizations should review their current deployment state against the repository commit history.

Exploitability

Exploitation is straightforward and requires only valid user credentials and network access to the Certificate Verification Endpoint. The attack is remotely exploitable with no special user interaction required (CVSS vector: AV:N/AC:L/PR:L/UI:N). Public exploit code is available, lowering the barrier to weaponization. Insider threats, compromised accounts, or lateral movement within an organization could enable this attack.

Remediation

The project has not yet released a formal patch despite early notification. Organizations should immediately review the Kushan2k repository for commits after f16a4ceaddd6729c4b306ed4641cda3176c1ef2a that address SQL injection in GradeController.php. Input validation and parameterized queries must replace string concatenation for all database operations. As a temporary control, restrict access to the Certificate Verification Endpoint to trusted networks and monitor for suspicious SQL patterns in logs.

Patch guidance

Because this project uses rolling releases without version numbers, patching requires monitoring the upstream repository. Check the Kushan2k GitHub repository for commits addressing SQL injection in controllers/GradeController.php after the vulnerable commit. Apply any available fixes and test thoroughly in a staging environment before production deployment. If no upstream patch is available, implement the fix locally by using parameterized queries (prepared statements) for all nic parameter handling, ensuring proper input validation and output encoding.

Detection guidance

Monitor application logs for SQL syntax errors or unusual query patterns in certificate verification requests. Look for requests to the getStatus endpoint containing SQL metacharacters (quotes, semicolons, UNION keywords) in the nic parameter. Implement Web Application Firewall (WAF) rules to block common SQL injection patterns. Database query logging can reveal malicious SQL attempts. Search for evidence of unauthorized data extraction or modification in academic records, particularly in grade or certificate tables. Check for failed and successful authentication attempts preceding suspicious queries.

Why prioritize this

This vulnerability merits prompt attention due to the combination of public exploit availability, authenticated-but-easy exploitation, and sensitive data exposure risk in an educational context. The MEDIUM CVSS score (6.3) may understate business impact given the nature of academic records and certificate fraud potential. The lack of a vendor response despite notification increases urgency for defensive action on your infrastructure.

Risk score, explained

CVSS 6.3 reflects remote network exploitability (AV:N), low attack complexity (AC:L), authenticated access requirement (PR:L), and impact to confidentiality, integrity, and availability of one impacted security property (C:L/I:L/A:L). The score does not weight the reputational risk of certificate fraud or the availability of public exploits. Organizations should layer this metric with business context: certificate system compromise may warrant elevated internal risk ratings.

Frequently asked questions