CVE-2026-10620: Student Admission System SQLi Vulnerability

CVE-2026-10620 Overview

CVE-2026-10620 is a SQL injection vulnerability in code-projects Student Admission System 1.0. The flaw resides in the /index.php script, where the eid and did parameters are concatenated into SQL statements without proper sanitization. Remote attackers can exploit the issue without authentication or user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic abuse against exposed installations. The weakness is classified under [CWE-74] (improper neutralization of special elements in output used by a downstream component).

Critical Impact
Unauthenticated remote attackers can manipulate backend database queries through the eid and did parameters in /index.php, leading to data disclosure, tampering, or full database compromise.

Affected Products

code-projects Student Admission System 1.0
Deployments exposing the vulnerable /index.php endpoint
Downstream forks or redistributed copies sharing the same codebase

Discovery Timeline

2026-06-02 - CVE-2026-10620 published to the National Vulnerability Database (NVD)
2026-06-04 - EPSS scoring published for CVE-2026-10620
2026-06-04 - Last updated in NVD database

Technical Details for CVE-2026-10620

Vulnerability Analysis

The vulnerability is a classic SQL injection issue in the /index.php request handler of the Student Admission System. The application accepts the eid and did request parameters and incorporates them into SQL queries without parameterization or input validation. Because the application processes requests over HTTP and does not require authentication for the affected code path, an attacker can deliver a malicious payload directly from the network. Successful exploitation enables attackers to read, modify, or delete records, depending on the privileges assigned to the database account used by the application. The public availability of the proof-of-concept lowers the technical barrier for adversaries to weaponize the issue.

Root Cause

The root cause is the direct concatenation of attacker-controlled eid and did values into SQL statements without prepared statements, parameter binding, or input sanitization. The application also lacks server-side type validation that would constrain these identifiers to numeric values, allowing arbitrary SQL syntax to reach the database driver.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker crafts an HTTP request to /index.php and supplies a SQL injection payload in the eid or did parameter. The injected SQL is executed within the application's database context. Refer to the VulDB CVE-2026-10620 Record and GitHub CVE Issue Discussion #12 for the disclosed proof-of-concept details.

No verified exploit code is reproduced here. Technical specifics are available in the references above.

Detection Methods for CVE-2026-10620

Indicators of Compromise

HTTP requests to /index.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the eid or did parameters
Anomalous database errors logged by the web application or backend MySQL/MariaDB server
Unexpected outbound database queries returning large result sets to the application tier

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query string and POST body parameters eid and did for SQL injection signatures
Enable database query logging and alert on queries containing concatenated identifiers with control characters originating from the application user
Correlate web access logs with database error logs to identify probing attempts against /index.php

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for cross-source correlation
Track request rate and parameter entropy on /index.php to surface automated injection scanners
Monitor for new user accounts, modified records, or schema-level changes in the admissions database

How to Mitigate CVE-2026-10620

Immediate Actions Required

Restrict access to the Student Admission System to trusted networks or place it behind authenticated reverse proxies until a fix is applied
Apply WAF signatures that block SQL injection patterns targeting the eid and did parameters on /index.php
Rotate database credentials and audit the database for unauthorized changes if exposure is suspected

Patch Information

No vendor patch has been referenced in the disclosure data for code-projects Student Admission System 1.0. Operators should monitor the Code Projects Security Overview and the VulDB Vulnerability #367928 entry for updates. In the absence of an official fix, administrators should remediate the source code by replacing string concatenation with parameterized queries using PDO or mysqli prepared statements.

Workarounds

Modify /index.php to cast eid and did to integers using intval() before use in SQL statements
Replace inline SQL with prepared statements that bind eid and did as typed parameters
Apply least-privilege principles to the database account used by the application, restricting it to required tables and operations

bash

# Example hardening: enforce integer casting and prepared statements in /index.php
# Before (vulnerable):
#   $sql = "SELECT * FROM students WHERE eid = '".$_GET['eid']."' AND did = '".$_GET['did']."'";
#
# After (mitigated):
$eid = (int) ($_GET['eid'] ?? 0);
$did = (int) ($_GET['did'] ?? 0);
$stmt = $pdo->prepare("SELECT * FROM students WHERE eid = :eid AND did = :did");
$stmt->execute([':eid' => $eid, ':did' => $did]);