Description

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store() functions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-17T18:17:09.320Z",
  "pubdate": "2026-08-17T18:17:09.320Z",
  "executiveSummary": "An SQL Injection vulnerability has been identified in the StudIP learning management system, specifically affecting versions 6.0.x prior to 6.0.3 and 5.4.x prior to 5.4.12. The security flaw resides within the internal store() functions, which improperly handle user-supplied input before incorporating it into database queries. This architectural weakness allows a remote, unauthenticated or authenticated attacker depending on specific endpoint exposure to inject malicious SQL commands directly into the underlying database backend.\nThe resulting impact is critical, as successful exploitation enables remote attackers to execute arbitrary code within the context of the database server or application environment, and to exfiltrate highly sensitive information stored within the StudIP repository. Risk implications include complete confidentiality, integrity, and availability compromises of the affected instance, potentially exposing institutional data, user credentials, and academic records. Exploitation requires network access to the target application and hinges on the lack of parameterized queries or input sanitization inside the vulnerable store() functions.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and improper neutralization of special elements used in SQL commands within the store() functions of StudIP versions 6.0.x before 6.0.3 and 5.4.x before 5.4.12. When parameters processed by these functions are passed directly to database query execution mechanisms without adequate abstraction or contextual escaping, an attacker can manipulate the query logic.\nThe attack flow begins when a remote attacker crafts a malicious payload containing SQL syntax and submits it via HTTP requests directed at application endpoints that invoke the vulnerable store() functions. Because the application fails to properly sanitize or parameterize the incoming data, the database interpreter evaluates the attacker-controlled input as executable SQL commands rather than inert literal data.\nNetwork exposure is defined by the web accessibility of the StudIP deployment. Depending on the specific implementation of the vulnerable store() functions, the attack surface may be reachable over standard HTTP/HTTPS ports without requiring prior authentication, or it may require low-privilege user credentials to access the relevant application modules.\nPayload behavior during successful exploitation allows the adversary to perform error-based, union-based, or blind SQL injection attacks. Through these techniques, the attacker can extract sensitive information, including password hashes, session identifiers, and personally identifiable information from the database tables.\nFurthermore, depending on database configuration settings, underlying privileges, and DBMS-specific features such as stacked queries or user-defined functions, post-exploitation impact can escalate to arbitrary code execution on the hosting operating system. This allows the threat actor to establish persistence, pivot to internal network segments, or compromise the entire infrastructure hosting the StudIP instance."
}