CVE-2026-86213: College Management System SQL Injection Flaw

CVE-2026-86213 Overview

CVE-2026-86213 is a SQL injection vulnerability in the Mstfakts College-Management-System, an open-source PHP-based academic management application. The flaw resides in the mysqli_query call within Front-end/university.php, part of the application's Search Handler component. Attackers can manipulate the book_name and book_author request parameters to inject arbitrary SQL statements. The issue is exploitable remotely without authentication or user interaction. The project uses a rolling release model, so no fixed version identifiers are published. Public exploit details are available, and the maintainer has not responded to the disclosure report.

Critical Impact
Unauthenticated remote attackers can inject SQL through the book_name or book_author parameters, exposing or modifying application database contents.

Affected Products

Mstfakts College-Management-System (rolling release, all versions)
Component: Front-end/university.php Search Handler
Vulnerable function call: mysqli_query with unsanitized book_name / book_author input

Discovery Timeline

2026-09-06 - CVE-2026-86213 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86213

Vulnerability Analysis

The vulnerability is a classic SQL injection classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The Search Handler in Front-end/university.php accepts user-supplied search terms and concatenates them directly into a SQL query executed via mysqli_query. Because the parameters book_name and book_author are not parameterized or escaped, an attacker can break out of the intended string context and append arbitrary SQL clauses. Successful exploitation can enumerate database schemas, exfiltrate stored user records, alter data, or, depending on database privileges, execute administrative operations. The attack requires only network access to the affected endpoint.

Root Cause

The root cause is the direct interpolation of HTTP request parameters into a SQL statement without prepared statements or input validation. The PHP mysqli extension supports parameterized queries via mysqli_prepare and bind_param, but the affected code path invokes mysqli_query on a concatenated string. This coding pattern eliminates any separation between query structure and untrusted data.

Attack Vector

An attacker sends a crafted HTTP request to the university search endpoint, embedding SQL syntax within the book_name or book_author parameters. No credentials or user interaction are required. Public references, including the associated GitHub issue and VulDB entry, describe the injection pattern. See the VulDB CVE-2026-86213 entry and GitHub Issue #5 for the disclosure context.

No verified proof-of-concept code is included here. The vulnerability manifests when the Search Handler concatenates the book_name or book_author request parameters into the SQL statement passed to mysqli_query. Refer to the external references for technical exploitation details.

Detection Methods for CVE-2026-86213

Indicators of Compromise

HTTP requests to Front-end/university.php containing SQL metacharacters such as ', ", --, /*, UNION, or SLEEP( in the book_name or book_author parameters.
Unexpected database errors, malformed query warnings, or long response times originating from the university search endpoint.
Outbound queries or connections from the web server following anomalous search requests.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect query strings and POST bodies targeting university.php for common SQL injection payloads.
Enable MySQL general or slow query logging and alert on queries containing tautologies (OR 1=1), stacked statements, or information_schema references.
Review application logs for HTTP 500 responses tied to the Search Handler, which frequently indicate injection attempts causing SQL parse failures.

Monitoring Recommendations

Ingest web server, WAF, and database logs into a centralized analytics platform for correlation across the request lifecycle.
Baseline typical search parameter length and character sets, then alert on statistical outliers.
Monitor the database service account used by the application for unusual SELECT volumes, schema enumeration, or access to non-search tables.

How to Mitigate CVE-2026-86213

Immediate Actions Required

Restrict network exposure of the College-Management-System until a fix is applied, for example by placing it behind authenticated VPN access or IP allow-lists.
Deploy WAF signatures that block SQL injection patterns targeting the book_name and book_author parameters on Front-end/university.php.
Audit the database user account used by the application and reduce its privileges to the minimum required for read operations.

Patch Information

No official patch is available. The project maintainer has not responded to the disclosure, and the rolling release model does not identify a fixed version. Consult the GitHub Project Repository and GitHub Issue #5 for status updates. Organizations that maintain their own fork should refactor the affected query to use mysqli_prepare with bind_param and validate input types before execution.

Workarounds

Apply a source-level fix by replacing the vulnerable mysqli_query call in Front-end/university.php with a prepared statement binding book_name and book_author as string parameters.
Add server-side input validation that rejects search terms containing SQL metacharacters or exceeding expected length limits.
If the search feature is not required, disable the university search endpoint by removing or restricting access to Front-end/university.php.

bash

# Example WAF rule (ModSecurity) blocking SQLi patterns on the search endpoint
SecRule REQUEST_URI "@contains /Front-end/university.php" \
  "phase:2,chain,deny,status:403,id:1026862130,msg:'Possible SQLi against CVE-2026-86213'"
  SecRule ARGS:book_name|ARGS:book_author "@rx (?i)(union(\s|\+)+select|or\s+1=1|sleep\(|information_schema|--|;)"