CVE-2026-51346: Stud.IP SQL Injection Vulnerability

CVE-2026-51346 Overview

CVE-2026-51346 is a SQL Injection vulnerability [CWE-89] in Stud.IP, an open-source campus management system used by universities and educational institutions. The flaw affects Stud.IP 6.0.x before 6.0.3 and 5.4.x before 5.4.12. Remote attackers can inject arbitrary SQL statements through the store() functions without authentication. Successful exploitation allows arbitrary code execution and disclosure of sensitive data stored in the application database.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL, read sensitive records, and pivot to code execution against Stud.IP deployments serving academic institutions.

Affected Products

Stud.IP 6.0.x prior to 6.0.3
Stud.IP 5.4.x prior to 5.4.12
Deployments exposing the vulnerable store() functions to network traffic

Discovery Timeline

2026-08-17 - CVE-2026-51346 published to the National Vulnerability Database (NVD)
2026-08-17 - Last updated in NVD database
Technical analysis published by Simon Hilchenbach (SQL Injection Analysis)

Technical Details for CVE-2026-51346

Vulnerability Analysis

The vulnerability resides in the store() functions used by Stud.IP to persist model data to the underlying database. Attacker-controlled input reaches SQL query construction without proper parameterization or sanitization. Because the vulnerable code paths are reachable over the network and require no authentication, an attacker only needs to send crafted HTTP requests to a vulnerable instance.

Exploitation extends beyond typical data exfiltration. According to the vendor advisory, the flaw permits arbitrary code execution in addition to disclosure of sensitive information. This elevates the vulnerability from a database read primitive to a full application compromise vector, likely through techniques such as writing files via SELECT INTO OUTFILE, chaining SQL to application logic, or manipulating serialized objects persisted through the affected functions.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The store() functions concatenate attacker-influenced values into SQL statements instead of using bound parameters. See the Simon Hilchenbach SQL Injection Analysis for the detailed code path.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends specially crafted requests to endpoints that invoke the vulnerable store() functions. The malicious payload alters the query structure, letting the attacker read arbitrary tables, modify records, or leverage database features to achieve code execution on the server.

No verified public exploit code is available at the time of writing. See the GitLab Stud.IP Release v6.0.3 notes for fix details.

Detection Methods for CVE-2026-51346

Indicators of Compromise

HTTP requests to Stud.IP endpoints containing SQL metacharacters such as ', --, UNION SELECT, or SLEEP( in POST bodies or query parameters
Web server logs showing anomalous request volumes to routes that invoke model persistence handlers
Database error messages, stack traces, or 500-response spikes correlated with unusual input
Creation of unexpected files in web-accessible directories, indicating potential INTO OUTFILE abuse

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag SQL injection patterns targeting Stud.IP routes
Enable and review MySQL or MariaDB general query logs for suspicious UNION, SLEEP, or LOAD_FILE statements originating from the Stud.IP database user
Correlate web access logs with database query logs to identify request-to-query anomalies
Verify installed Stud.IP versions against the fixed builds 6.0.3 and 5.4.12

Monitoring Recommendations

Alert on outbound connections initiated by the Stud.IP application server, which may indicate post-exploitation activity
Monitor for new administrative accounts or privilege changes in the Stud.IP auth_user_md5 and related tables
Track file writes under the web root and public/ directories for unexpected PHP files

How to Mitigate CVE-2026-51346

Immediate Actions Required

Upgrade Stud.IP 6.0.x deployments to 6.0.3 or later
Upgrade Stud.IP 5.4.x deployments to 5.4.12 or later
Restrict network access to Stud.IP administrative and API endpoints from untrusted networks until patching is complete
Audit database and web server logs for signs of prior exploitation dating back to the exposure window

Patch Information

The vendor released fixed builds in Stud.IP 6.0.3 and 5.4.12. Refer to the GitLab Stud.IP Release v6.0.3 notes for change details. Administrators should apply the corresponding patch for their branch and validate database schema migrations before returning the instance to production.

Workarounds

Place a WAF in front of Stud.IP with signatures blocking SQL injection payloads on write-heavy endpoints
Enforce least-privilege on the Stud.IP database user, revoking FILE, SUPER, and unnecessary write privileges to limit escalation from SQL injection to code execution
Isolate the Stud.IP host on a segmented network to reduce blast radius if exploitation occurs

bash

# Verify installed Stud.IP version and confirm patched build
grep -R "STUDIP_VERSION" /path/to/studip/config/ | head

# Restrict database user privileges (example for MySQL/MariaDB)
REVOKE FILE, SUPER ON *.* FROM 'studip'@'localhost';
FLUSH PRIVILEGES;