SQL Injection in Simple Student Information System

SourceCodester Simple Student Information System version 1.0 contains a SQL injection vulnerability within the searchquery.php script. The application fails to properly sanitize user-supplied input before incorporating it into database queries, allowing remote, unauthenticated attackers to inject arbitrary SQL commands. This vulnerability can lead to unauthorized data exfiltration, modification, or potential administrative bypass depending on the database configuration and permissions associated with the application's service account. Because the vulnerability is exploitable remotely, it presents a significant risk to organizations hosting this software in internet-facing environments.

Impact

Successful exploitation of this vulnerability allows unauthorized access to the underlying database. Depending on the environment, this may lead to the exposure of sensitive student records, compromise of user authentication credentials, or full application takeover.

Recommendation

Identify all instances of Simple Student Information System 1.0 in your environment. Since the vendor has not provided a patch as of the report date, implement strict input validation at the web application firewall (WAF) level to block SQL injection patterns targeting searchquery.php. Restrict access to the application to trusted internal networks until a remediation version is available.