Cpe:2.3:a:kusalkasilva:learning-Management-System:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3akusalkasilvalearning-management-system/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 06 Oct 2026 12:55:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection in Kusalkasilva Learning-Management-System Login Endpointhttps://feed.craftedsignal.io/briefs/2026-10-kusalkasilva-sqli/Tue, 06 Oct 2026 12:55:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-kusalkasilva-sqli/A remote, unauthenticated SQL injection vulnerability in the login.php script of Kusalkasilva Learning-Management-System allows attackers to compromise database integrity.The Kusalkasilva Learning-Management-System is susceptible to a SQL injection vulnerability (CVE-2026-105918) within the mysql_error function located in the login.php file. This component handles the Login Endpoint for the application. Remote attackers can leverage this vulnerability by providing malicious input into the username or password parameters, enabling them to alter database queries. This flaw, which carries a CVSS v3.1 base score of 7.3, poses a significant risk as the exploit is publicly available. Because the project utilizes a continuous delivery model with rolling releases, no specific patched versions or version ranges are available; users should monitor the project repository for updates and maintain defense-in-depth controls around database access.

Impact

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database. This may lead to unauthorized data exfiltration, modification of application records, or complete compromise of the learning management system's data integrity.

Recommendation

  • Implement web application firewall (WAF) rules to inspect and filter SQL injection payloads in the username and password parameters of login.php.
  • Apply the principle of least privilege to the database service account used by the Learning-Management-System to limit the potential impact of successful query manipulation.
  • Monitor logs for unusual database error patterns or unexpected login attempts that deviate from standard user activity.
  • Monitor the Kusalkasilva Learning-Management-System source repository for commit notifications indicating a security fix for the mysql_error function.
]]>highadvisory