SQL Injection Vulnerability in Student-Management-System

A critical SQL injection vulnerability, tracked as CVE-2026-18958, has been identified in the Student-Management-System component maintained by imranrisal-dev. The flaw exists within the loginCheckTest.php file, which processes login requests for the application. Due to insufficient input sanitization of the username and password parameters, an unauthenticated remote attacker can inject arbitrary SQL commands into the backend database. This vulnerability allows for unauthorized data access, modification of existing records, or potential bypass of authentication mechanisms. The vendor has not responded to disclosure attempts, and proof-of-concept exploit code is currently public, significantly increasing the risk of exploitation.

Impact

Successful exploitation of this vulnerability permits remote attackers to perform unauthorized database queries. This can lead to full compromise of the application data, including sensitive student information, administrator credentials, or configuration data. Given the lack of vendor response and the public availability of exploits, all instances of this software are at high risk of automated or targeted exploitation attempts.

Recommendation

• Perform an inventory of all instances of the Student-Management-System within the environment.
• Implement strict input validation or Web Application Firewall (WAF) rules to inspect and filter POST requests to loginCheckTest.php for SQL syntax characters.
• Evaluate the necessity of hosting this software; if it is not business-critical, disconnect it from the network until a patch or mitigation is verified.
• Monitor web server logs for suspicious activity targeting the loginCheckTest.php endpoint.