CVE-2026-82620: Soarkey StudentManagement SQL Injection

CVE-2026-82620 Overview

CVE-2026-82620 is a SQL injection vulnerability in the Soarkey StudentManagement project (学生信息管理系统), an open-source Java-based student information management system. The flaw resides in the CourseDao.course_ranking function within code/src/dao/CourseDao.java. An attacker can manipulate the cno parameter to inject arbitrary SQL statements. The issue affects the codebase up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e. Exploitation requires network access and low-privilege authentication. Public exploit details have been released, and the maintainers were notified through a GitHub issue but have not responded. The weakness is classified under [CWE-74] improper neutralization of special elements in output.

Critical Impact
Authenticated remote attackers can inject SQL into the course ranking query, allowing unauthorized read or modification of application database contents.

Affected Products

Soarkey StudentManagement (学生信息管理系统)
Repository state up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e
Vulnerable file: code/src/dao/CourseDao.java

Discovery Timeline

2026-08-31 - CVE-2026-82620 published to NVD
2026-09-01 - Last updated in NVD database
2026-09-03 - EPSS score published (0.204%, percentile 10.388)

Technical Details for CVE-2026-82620

Vulnerability Analysis

The vulnerability is a classic SQL injection weakness in a Java Data Access Object (DAO). The course_ranking method of the CourseDao class accepts a cno (course number) argument from an upstream caller and incorporates it into a SQL query without proper parameterization. Because the value is concatenated into the statement rather than bound as a prepared parameter, attacker-supplied SQL fragments are executed by the backend database.

Exploitation requires only low-privilege access, since the affected endpoint is reachable by authenticated application users. The impact spans confidentiality, integrity, and availability at a limited scope, consistent with unauthorized read and write access to records handled by the course ranking query. A public exploit is documented in the associated VulDB entry and referenced from the GitHub issue tracker.

Root Cause

The root cause is string concatenation of untrusted input into a SQL query inside CourseDao.course_ranking. The cno parameter is passed directly into the SQL statement executed against the backing database. There is no use of PreparedStatement bind variables or input validation, so metacharacters such as single quotes, comment sequences, and UNION keywords remain semantically active. This matches the [CWE-74] pattern of failing to neutralize special elements in output used by a downstream component.

Attack Vector

The attack vector is network-based against the web application front end that invokes the course_ranking operation. An authenticated user submits a crafted cno value through the exposed course-ranking request path. The manipulated parameter reaches the DAO layer and alters the SQL query semantics. Successful injection can be used for data extraction with UNION SELECT payloads, boolean or time-based blind enumeration, or destructive statements when database privileges permit.

No verified exploit code is included here. Refer to the VulDB CVE-2026-82620 entry and the GitHub Issue #33 Discussion for public technical details.

Detection Methods for CVE-2026-82620

Indicators of Compromise

Web access log entries targeting the course ranking endpoint with SQL metacharacters in the cno parameter, including single quotes, --, /*, UNION, or SLEEP(.
Database error messages or stack traces returned to the client referencing CourseDao.course_ranking or JDBC exceptions.
Anomalous outbound result sizes from the course ranking query, indicating UNION-based extraction.

Detection Strategies

Enable verbose query logging on the backing database and alert on statements originating from CourseDao.course_ranking that contain concatenated SQL keywords.
Deploy a web application firewall rule to inspect the cno request parameter for SQL injection signatures.
Perform static analysis on code/src/dao/CourseDao.java to identify string-concatenated SQL and unparameterized Statement.execute calls.

Monitoring Recommendations

Monitor authenticated user sessions for repeated failed or malformed course ranking requests followed by unusually large response payloads.
Correlate application logs with database audit logs to detect queries that deviate from the expected course_ranking template.
Track outbound network egress from the application server for unexpected data exfiltration following ranking requests.

How to Mitigate CVE-2026-82620

Immediate Actions Required

Restrict network access to the StudentManagement application to trusted users only, using VPN or IP allow-listing until a fix is available.
Enforce least privilege on the database account used by the application, removing DROP, ALTER, and FILE permissions.
Add server-side input validation to reject non-numeric values for the cno parameter before it reaches the DAO layer.

Patch Information

At the time of publication, the maintainers of the Soarkey StudentManagement project have not responded to the disclosure filed as GitHub Issue #33, and no official patch has been released. Organizations running this project must apply a local code fix that replaces the vulnerable concatenated SQL in CourseDao.course_ranking with a PreparedStatement and bind the cno argument as a parameter. Track updates through the GitHub Student Management Repository for any future release addressing the issue.

Workarounds

Refactor CourseDao.course_ranking locally to use PreparedStatement with parameter binding for the cno value.
Add a web application firewall rule that blocks SQL metacharacters in the cno parameter on the course ranking endpoint.
Disable or remove the course ranking feature in deployments where it is not required.

bash

# Configuration example: WAF rule pattern to block SQL metacharacters in cno parameter
# ModSecurity-style rule for the course ranking endpoint
SecRule ARGS:cno "@rx (?i)(\bunion\b|\bselect\b|--|/\*|;|'|\bsleep\s*\()" \
    "id:1082620,\
    phase:2,\
    deny,\
    status:403,\
    msg:'CVE-2026-82620 SQL injection attempt on cno parameter'"