A flaw has been found in ProjectsAndPrograms School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file owner_panel/fetch-data/select-students.php. This manipulation of the argument select causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 2.1 · oranbyteNVD modified 2026-10-09 10:10
Affected (CPE criteria) 1
cpe:2.3:a:oranbyte:school_management_system:1.0:*:*:*:*:*:*:*
References 5
- https://gold-textbook-8ff.notion.site/school-management-system-student_panel-Owner-end-select-students-php-delay-SQL-injection-27485e97f35380a1b482c8e079cd6503 Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.326096 Permissions Required, VDB Entry
- https://vuldb.com/?id.326096 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.659463 Third Party Advisory, VDB Entry
- https://gold-textbook-8ff.notion.site/school-management-system-student_panel-Owner-end-select-students-php-delay-SQL-injection-27485e97f35380a1b482c8e079cd6503 Exploit, Third Party Advisory