Description

A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /student_edit1.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-29T23:17:24.080Z",
  "pubdate": "2026-08-29T23:17:24.080Z",
  "executiveSummary": "A SQL injection vulnerability exists in version 1.0 of the PHPGurukul Student Information System. The vulnerability resides within the '/student_edit1.php' file, where the 'ID' parameter fails to adequately sanitize user-supplied input before incorporating it into database queries. This flaw allows a remote, unauthenticated attacker to manipulate the execution of SQL commands, leading to unauthorized database access.\nThe primary impact of this vulnerability is the potential for complete compromise of the underlying database. Successful exploitation permits an attacker to bypass authentication, disclose sensitive student information, modify or delete data, and potentially gain administrative control over the application. Given that the exploit code is publicly available, the risk to deployments is critical. The attack is executable remotely, requiring no prior system access, and poses a significant threat to data confidentiality, integrity, and availability.",
  "technicalDetails": "The root cause of this vulnerability is improper neutralization of special elements used in an SQL command within the 'student_edit1.php' file of the PHPGurukul Student Information System 1.0. Specifically, the 'ID' argument, which is expected to pass a numerical identifier for a student record, is processed by the server-side script without sufficient input validation or the use of prepared statements.\nThe exploitation method involves injecting malicious SQL syntax into the 'ID' parameter. When the application processes the request, the injected payload alters the structure of the intended SQL query. An attacker can use techniques such as UNION-based SQL injection to exfiltrate data from other tables within the database schema. By appending 'UNION SELECT' statements, the attacker can force the application to return unintended rows or disclose database versioning, user credentials, or system configuration details.\nThe attack flow follows these steps: first, the attacker identifies the target endpoint '/student_edit1.php'. Second, the attacker crafts a malicious HTTP GET or POST request where the 'ID' parameter is appended with SQL meta-characters such as single quotes ('), comment operators (--), or boolean logic (e.g., 'OR 1=1'). Third, the backend server executes the modified query, effectively bypassing intended programmatic constraints. Finally, the server returns the results of the malicious query to the attacker, or confirms the injection via time-based or boolean-based inference.\nThis vulnerability is classified as critical because it is remotely exploitable without authentication, meaning an adversary does not need a user account or privileged access to trigger the flaw. The lack of parameterized queries or rigorous input sanitization on the 'ID' parameter makes the application highly susceptible to automated exploitation tools that can rapidly dump database contents. Post-exploitation, the impact is severe, potentially allowing for the exfiltration of the entire student database, including private PII (Personally Identifiable Information), or the potential escalation of privileges if the database user has high-level permissions on the hosting server."
}