PatchSiren cyber security CVE debrief
CVE-2026-10225 raisulislamg4 CVE debrief
A SQL injection vulnerability exists in the student_management_system_by_php repository by raisulislamg4, affecting the login_check.php file's Username parameter. The vulnerability allows remote, unauthenticated attackers to manipulate SQL queries through crafted input. The project uses a rolling release model without discrete version numbers, complicating patch identification. The maintainer was notified via a GitHub issue but had not responded as of the CVE publication date. The exploit is publicly available, increasing active exploitation risk.
- Vendor
- raisulislamg4
- Product
- student_management_system_by_php
- CVSS
- MEDIUM 5.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-01
- Original CVE updated
- 2026-06-01
- Advisory published
- 2026-06-01
- Advisory updated
- 2026-06-01
Who should care
Organizations running instances of this student management system; PHP application developers maintaining similar authentication flows; security teams monitoring for SQL injection in educational software deployments
Technical summary
The vulnerability resides in login_check.php where the Username parameter is concatenated directly into SQL queries without parameterization. An attacker can inject arbitrary SQL syntax to bypass authentication, extract data, or modify database contents. The attack requires no authentication and can be executed remotely with standard HTTP requests. The rolling release model means affected instances must be assessed against commit 310d950e09013d5133c6b9210aff9444382d16d1 or later for fix status.
Defensive priority
medium
Recommended defensive actions
- Review and restrict network access to affected student_management_system_by_php instances until patched
- Implement parameterized queries or prepared statements for all database interactions in login_check.php
- Apply input validation and sanitization for the Username parameter using allowlists
- Monitor database query logs for anomalous SQL syntax or unauthorized schema access
- Consider Web Application Firewall (WAF) rules to detect SQL injection patterns in login requests
- Track GitHub issue #2 for vendor response and official patch availability
Evidence notes
Vuldb CNA submission and NVD record confirm SQL injection in login_check.php Username parameter. GitHub issue #2 documents early vendor notification without response. CVSS 4.0 vector indicates network attack vector with low complexity and no privileges required. CWE-74 and CWE-89 classify as injection weakness.
Official resources
public