CVE-2026-11475: Student Management System SQL Injection

CVE-2026-11475 is a SQL injection vulnerability in Kushan2k student-management-system affecting the Certificate Verification Endpoint. Attackers can remotely exploit this flaw via the nic parameter. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-11475 Overview

CVE-2026-11475 is a SQL injection vulnerability in the Kushan2k student-management-system project, affecting commits up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. The flaw resides in the getStatus function of controllers/GradeController.php, which serves as the Certificate Verification Endpoint. Attackers can manipulate the nic argument to inject arbitrary SQL statements remotely. The project follows a rolling release model, so no specific affected or fixed versions are enumerated. A public exploit is available, and the maintainer has not responded to the issue report.

Critical Impact
Remote attackers with low privileges can inject SQL through the nic parameter to read or alter backend database contents via the certificate verification endpoint.

Affected Products

Kushan2k student-management-system (rolling release)
Commits up to and including f16a4ceaddd6729c4b306ed4641cda3176c1ef2a
Component: Certificate Verification Endpoint (controllers/GradeController.php)

Discovery Timeline

2026-06-08 - CVE-2026-11475 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11475

Vulnerability Analysis

The vulnerability is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). The getStatus function in controllers/GradeController.php accepts a user-controlled nic parameter and concatenates it into a SQL query without proper parameterization or input sanitization. As a result, attackers can break out of the intended query context and inject arbitrary SQL syntax.

The endpoint is reachable over the network and requires only low-level privileges to invoke. Successful exploitation can disclose stored student records, modify grade or certificate verification state, or be used as a foothold for further database tampering. Because the project ships continuously without versioned releases, downstream operators must track the upstream Git history directly to assess exposure.

Root Cause

The root cause is the lack of prepared statements or parameter binding when handling the nic request parameter inside getStatus. User input flows directly into the SQL query string, allowing syntax injection.

Attack Vector

An unauthenticated or low-privileged remote user sends a crafted HTTP request to the certificate verification endpoint with a malicious value in the nic parameter. The injected payload is appended to the SQL statement executed by the backend, returning attacker-controlled query results or altering the database. A public proof of concept has been released through VulDB CVE-2026-11475 and the associated GitHub Issue #2.

No verified exploit code is republished here. See the linked references for technical details.

Detection Methods for CVE-2026-11475

Indicators of Compromise

HTTP requests to the certificate verification endpoint containing SQL meta-characters such as ', --, UNION, SELECT, or OR 1=1 in the nic parameter.
Anomalous database errors logged by PHP or MySQL referencing GradeController.php or the getStatus function.
Unexpected outbound result sizes or row counts from the certificate verification query.

Detection Strategies

Inspect web server access logs for requests targeting the grade or certificate verification routes with non-alphanumeric nic values.
Enable database query logging and alert on syntactically unusual queries originating from GradeController.php.
Deploy a web application firewall ruleset that flags SQL injection patterns on the affected endpoint.

Monitoring Recommendations

Monitor authentication and session activity for accounts that interact with the certificate verification endpoint outside normal workflows.
Track database account activity for unexpected SELECT patterns against grade or student tables.
Forward web and database telemetry to a centralized analytics platform for correlation across the application stack.

How to Mitigate CVE-2026-11475

Immediate Actions Required

Restrict network exposure of the application until the nic parameter handling is fixed, for example by placing it behind authentication or VPN.
Patch getStatus in controllers/GradeController.php to use PDO prepared statements or parameter binding instead of string concatenation.
Enforce strict server-side validation on nic, allowing only the expected character set and length.

Patch Information

As of the NVD publication date, the upstream project has not responded to the disclosure tracked in GitHub Issue #2. No official patch or tagged release is available. Operators running forks should apply parameterized query fixes directly to controllers/GradeController.php and rebuild from the patched commit.

Workarounds

Deploy a web application firewall rule blocking SQL meta-characters on the certificate verification endpoint.
Limit the database account used by the application to read-only access on only the tables required by getStatus.
Disable or remove the certificate verification feature if it is not actively used in production.

bash

# Example WAF rule concept for ModSecurity
SecRule ARGS:nic "@rx [\'\"\;\-]{1,}|(?i)(union|select|or\s+1=1)" \
  "id:1026011475,phase:2,deny,status:403,msg:'CVE-2026-11475 SQLi attempt on nic parameter'"