CVE-2026-86518: Student Crud Operation SQL Injection Flaw

CVE-2026-86518 Overview

CVE-2026-86518 is a SQL injection vulnerability in code-projects Student Crud Operation 1.0. The flaw resides in the /edit.php script, where the ID parameter is passed to a backend database query without proper sanitization. An authenticated remote attacker can manipulate the ID argument to inject arbitrary SQL statements. Public analysis describes the issue as a time-based blind SQL injection, meaning attackers infer data by observing query delays. The exploit technique has been publicly disclosed, lowering the barrier to weaponization against exposed installations.

Critical Impact
Remote authenticated attackers can extract database contents, modify student records, or pivot to further compromise by injecting SQL through the id parameter of edit.php.

Affected Products

code-projects Student Crud Operation 1.0
/edit.php endpoint
Deployments exposing the id GET/POST parameter to untrusted users

Discovery Timeline

2026-09-08 - CVE-2026-86518 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86518

Vulnerability Analysis

The vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The edit.php script accepts the id parameter from HTTP requests and concatenates it directly into a SQL statement executed against the backing MySQL database. Because input is not validated, escaped, or bound as a parameter, attackers can append conditional SQL syntax such as AND SLEEP(n) to infer database state through response timing.

Exploitation requires low privileges. The attack is executed over the network with low complexity and no user interaction. Impact on confidentiality, integrity, and availability is limited, reflecting the constrained data scope of a single CRUD application rather than a broader enterprise system.

Root Cause

The root cause is the use of unsanitized user input in dynamic SQL statement construction. The application does not employ prepared statements, parameterized queries, or input validation on the id argument before passing it to the database driver. This pattern is common in small PHP learning projects that concatenate $_GET['id'] directly into query strings.

Attack Vector

An attacker with a valid low-privilege session sends a crafted HTTP request to /edit.php, appending SQL payloads to the id parameter. Because the injection is time-based blind, the attacker uses conditional delays such as SLEEP() to enumerate schema names, table structures, and row values one bit at a time. See the GitHub CVE Analysis for the disclosed technical write-up.

No verified proof-of-concept code is republished here. Refer to the linked advisory for payload structure and reproduction steps.

Detection Methods for CVE-2026-86518

Indicators of Compromise

HTTP requests to /edit.php where the id parameter contains SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, AND, or OR
Repeated requests to /edit.php with incrementally changing payloads, indicating blind enumeration
Database query logs showing anomalously long execution times tied to edit.php sessions
Web server access logs containing URL-encoded characters such as %27 (single quote) or %20 in the id parameter

Detection Strategies

Deploy a web application firewall (WAF) rule set that inspects the id parameter of /edit.php for SQL syntax and time-delay functions
Enable MySQL slow query logging and alert on queries originating from edit.php exceeding a defined threshold
Correlate authenticated session activity with abnormal request volumes to /edit.php from a single account

Monitoring Recommendations

Ingest web server, PHP error, and database logs into a centralized analytics platform for cross-source correlation
Baseline normal edit.php request patterns and alert on statistical deviations
Monitor outbound database connections for schema enumeration queries against information_schema

How to Mitigate CVE-2026-86518

Immediate Actions Required

Restrict access to /edit.php behind authenticated administrative sessions and IP allowlists until a code fix is applied
Deploy WAF signatures that block SQL injection payloads targeting the id parameter
Audit database accounts used by the application and enforce least-privilege permissions to limit blast radius
Review web and database logs for prior exploitation attempts against /edit.php

Patch Information

No vendor patch has been published in the referenced advisories at the time of disclosure. Consult the VulDB entry for CVE-2026-86518 and the code-projects site for updated fix availability. Operators should replace concatenated SQL statements in edit.php with parameterized queries using PDO or MySQLi prepared statements, and cast id to an integer before use.

Workarounds

Rewrite the query in edit.php to use PDO prepared statements with bound parameters for the id value
Apply strict type validation by casting $_GET['id'] to an integer before it reaches any SQL statement
Place the application behind a reverse proxy that terminates and inspects HTTP traffic for injection patterns
Remove or firewall the affected instance from public networks if it is not required for production use

bash

# Example WAF-style ModSecurity rule to block SQLi against edit.php
SecRule REQUEST_URI "@beginsWith /edit.php" \
  "chain,deny,status:403,id:1008651,msg:'SQLi attempt on Student CRUD edit.php'"
  SecRule ARGS:id "@rx (?i)(select|union|sleep|benchmark|--|;|\\bor\\b|\\band\\b)" "t:none,t:urlDecodeUni"