SQL Injection in School Management System 1.0 via User_Login.php

itsourcecode School Management System version 1.0 contains a critical SQL injection vulnerability identified as CVE-2026-86268. The vulnerability resides within the User_Login.php file, specifically involving insufficient input validation of the 'email' argument. An unauthenticated remote attacker can exploit this flaw by submitting a specially crafted SQL payload via the email parameter to trigger unauthorized database operations. Given the public availability of the exploit code, organizations utilizing this software are at significant risk of database compromise, including unauthorized data exfiltration or potential administrative takeover. The vulnerability has been assigned a CVSS v3.1 base score of 7.3.

Impact

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database. This may lead to the disclosure of sensitive user information, modification of application records, or complete compromise of the School Management System data store.

Recommendation

• Identify all instances of itsourcecode School Management System 1.0 within the environment.
• Patch or disable the affected School Management System software immediately as no vendor fix is currently specified.
• Implement a Web Application Firewall (WAF) to block suspicious POST requests to User_Login.php containing SQL syntax characters such as single quotes, double dashes, or UNION/SELECT keywords.