PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10225 raisulislamg4 CVE debrief

A SQL injection vulnerability exists in the student_management_system_by_php repository by raisulislamg4, affecting the login_check.php file's Username parameter. The vulnerability allows remote, unauthenticated attackers to manipulate SQL queries through crafted input. The project uses a rolling release model without discrete version numbers, complicating patch identification. The maintainer was notified via a GitHub issue but had not responded as of the CVE publication date. The exploit is publicly available, increasing active exploitation risk.

Vendor
raisulislamg4
Product
student_management_system_by_php
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running instances of this student management system; PHP application developers maintaining similar authentication flows; security teams monitoring for SQL injection in educational software deployments

Technical summary

The vulnerability resides in login_check.php where the Username parameter is concatenated directly into SQL queries without parameterization. An attacker can inject arbitrary SQL syntax to bypass authentication, extract data, or modify database contents. The attack requires no authentication and can be executed remotely with standard HTTP requests. The rolling release model means affected instances must be assessed against commit 310d950e09013d5133c6b9210aff9444382d16d1 or later for fix status.

Defensive priority

medium

Recommended defensive actions

  • Review and restrict network access to affected student_management_system_by_php instances until patched
  • Implement parameterized queries or prepared statements for all database interactions in login_check.php
  • Apply input validation and sanitization for the Username parameter using allowlists
  • Monitor database query logs for anomalous SQL syntax or unauthorized schema access
  • Consider Web Application Firewall (WAF) rules to detect SQL injection patterns in login requests
  • Track GitHub issue #2 for vendor response and official patch availability

Evidence notes

Vuldb CNA submission and NVD record confirm SQL injection in login_check.php Username parameter. GitHub issue #2 documents early vendor notification without response. CVSS 4.0 vector indicates network attack vector with low complexity and no privileges required. CWE-74 and CWE-89 classify as injection weakness.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10225 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10225

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10225 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10225

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.