SQL Injection Vulnerability in Mstfakts College-Management-System

A critical SQL injection vulnerability, identified as CVE-2026-86213, exists in the Mstfakts College-Management-System. The flaw resides within the search handler functionality located in 'Front-end/university.php'. Specifically, the 'mysqli_query' function fails to properly sanitize user input provided through the 'book_name' and 'book_author' parameters. This vulnerability allows remote, unauthenticated attackers to manipulate database queries, potentially leading to unauthorized data exfiltration or administrative access to the backend database. The vulnerability has been confirmed with publicly available proof-of-concept exploits. The vendor utilizes a continuous delivery model and has not released a patch or version update to address this flaw as of the current reporting.

Impact

The vulnerability poses a high risk to educational institutions utilizing the Mstfakts College-Management-System. Successful exploitation enables attackers to bypass application-level security, potentially compromising sensitive student, faculty, and administrative data stored within the underlying database.

Recommendation

Detection engineering teams should focus on identifying anomalous HTTP requests targeting the vulnerable search parameters.

• Deploy Web Application Firewall (WAF) rules to inspect and filter input for SQL keywords (e.g., UNION, SELECT, OR 1=1) targeting the 'book_name' and 'book_author' parameters in the 'Front-end/university.php' endpoint.
• Monitor web server access logs for anomalous characters (e.g., ';', '--', '/*') in query strings associated with 'university.php'.
• Implement strict input validation and parameterized queries within the application source code if local modifications are possible, as the vendor has not released an official update.