CVE-2026-10225: Student Management System SQL Injection

CVE-2026-10225 Overview

CVE-2026-10225 is a SQL injection vulnerability affecting the raisulislamg4 student_management_system_by_php project up to commit 310d950e09013d5133c6b9210aff9444382d16d1. The flaw resides in the login_check.php file within the Login component, where the Username parameter is concatenated into a database query without proper sanitization. Remote attackers can manipulate this argument to inject arbitrary SQL statements. The exploit has been disclosed publicly, increasing the likelihood of opportunistic abuse against exposed installations. Because the project follows a rolling release model, no fixed version is currently identified, and the maintainer has not responded to the issue report filed on the GitHub tracker.

Critical Impact
Unauthenticated remote attackers can inject SQL through the login form to bypass authentication, exfiltrate student records, or modify backend data.

Affected Products

raisulislamg4 student_management_system_by_php (rolling release)
Builds up to and including commit 310d950e09013d5133c6b9210aff9444382d16d1
The vulnerable login_check.php Login component

Discovery Timeline

2026-06-01 - CVE-2026-10225 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10225

Vulnerability Analysis

The vulnerability is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The Login component in login_check.php accepts the Username HTTP parameter and incorporates it directly into a SQL query string. Without parameterized queries or input escaping, attacker-supplied SQL syntax alters the query logic at runtime. An attacker reaches the endpoint over the network with no authentication and no user interaction. Successful exploitation impacts confidentiality, integrity, and availability of the backing database. According to the EPSS model (0.033%, percentile 10.197), automated mass exploitation is currently uncommon, though public exploit availability typically increases attack volume over time.

Root Cause

The root cause is unsanitized concatenation of user-supplied input into a SQL statement. The PHP code path responsible for authentication does not employ prepared statements with bound parameters. Standard payloads using single-quote breakouts and Boolean operators are sufficient to alter the authentication query.

Attack Vector

The attack is conducted remotely against the application's login endpoint. The attacker submits a crafted POST request with a malicious Username value. Common outcomes include authentication bypass, blind data extraction through Boolean or time-based techniques, and full database enumeration via UNION-based payloads. No credentials or prior session are required.

No verified proof-of-concept code is published in the referenced advisories. See the VulDB Vulnerability Details and the GitHub Issue Tracker for technical context.

Detection Methods for CVE-2026-10225

Indicators of Compromise

HTTP POST requests to login_check.php containing SQL meta-characters such as ', --, #, UNION, or SLEEP( in the Username parameter.
Web server logs showing repeated authentication attempts from a single source with malformed usernames.
Database error messages returned to clients indicating syntax errors in login queries.
Anomalous outbound database query patterns originating from the web application process.

Detection Strategies

Deploy web application firewall signatures that match SQL injection payloads targeting login form parameters.
Inspect application logs for Username values containing quote characters, comment markers, or SQL keywords.
Correlate failed login bursts with subsequent successful authentications from the same source IP.

Monitoring Recommendations

Enable verbose query logging on the MySQL or MariaDB backend and alert on queries containing tautologies such as OR 1=1.
Monitor for unexpected SELECT, UNION, or INFORMATION_SCHEMA references originating from the authentication code path.
Track HTTP 500 responses tied to login_check.php as a proxy for injection probing.

How to Mitigate CVE-2026-10225

Immediate Actions Required

Restrict public access to the application until a fix is applied, using IP allowlisting or VPN-only access.
Place a web application firewall in front of the application with SQL injection rulesets enabled in blocking mode.
Audit database accounts used by the web application and revoke privileges beyond what authentication requires.
Review recent access logs for indicators of compromise and rotate any credentials stored in the affected database.

Patch Information

No official patch has been released by the project maintainer. The issue was reported to the upstream repository, but as of the NVD publication date the project has not responded. Organizations running this codebase should fork the project and apply parameterized queries locally, or migrate to a maintained alternative. Track the GitHub Project Repository for any future fix commits.

Workarounds

Rewrite login_check.php to use PDO or mysqli prepared statements with bound parameters for the Username and password fields.
Apply server-side input validation that rejects any non-alphanumeric characters in the username field before query construction.
Enforce least-privilege database credentials so the web application account cannot read sensitive tables or execute DDL.

bash

# Example WAF rule snippet (ModSecurity) to block SQLi in the Username parameter
SecRule ARGS:Username "@rx (?i)(\b(union|select|or|and)\b.*\b(from|where|=)\b|--|#|;|')" \
  "id:1029010225,phase:2,deny,status:403,msg:'Possible SQLi against login_check.php (CVE-2026-10225)'"