Description

A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown function of the file aca.sql. Performing a manipulation results in use of default password. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-31T14:17:26.980Z",
  "pubdate": "2026-08-31T14:17:26.980Z",
  "executiveSummary": "The Student-Management-System, specifically versions up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5, contains a critical security vulnerability involving the use of a default password configured within the application's SQL database schema.\nThis vulnerability is categorized as a security misconfiguration, which allows unauthorized actors to gain administrative or unauthorized access to the application by utilizing known, hardcoded, or default credentials defined in the database initialization script.\nThe flaw resides in the aca.sql file, which governs the initial state and configuration of the database.\nThis vulnerability is remotely exploitable, requiring no prior authentication if the default credentials remain unchanged upon deployment.\nThe impact of this vulnerability is severe, potentially resulting in full system compromise, unauthorized access to sensitive student data, and administrative control over the management system.\nBecause the project maintains a rolling release approach and has not responded to vulnerability reports, systems currently using this software are at high risk of exploitation from public exploits.",
  "technicalDetails": "The vulnerability is rooted in the hardcoding of default credentials within the aca.sql initialization script, which is part of the Student-Management-System codebase up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5.\nIn a standard deployment scenario, the aca.sql file is utilized to populate the backend database with default tables, configurations, and administrative user accounts. The vulnerability occurs because this script includes predefined, predictable credentials for these administrative accounts rather than requiring a dynamic, user-defined password during the installation process.\nThe exploitation process is straightforward: a remote attacker identifies an instance of the Student-Management-System exposed to the network. Upon accessing the application's login interface, the attacker attempts to authenticate using the documented default credentials found within the public source code's aca.sql file.\nBecause the system is initialized with these static credentials, the authentication mechanism validates the attacker's request, granting them access with whatever privileges are associated with the default account, typically full administrative rights.\nThis represents a failure in implementing secure defaults, a principle requiring systems to be 'secure by design' and 'secure by default'. By failing to enforce a password change at the initial installation or by embedding weak credentials in the database schema, the application exposes its entire administrative backend to any entity capable of reaching the web interface over the network.\nPost-exploitation, the impact is comprehensive. An attacker possessing administrative access can manipulate the underlying database, extract sensitive student records, modify user information, or potentially execute further actions within the application environment, such as lateral movement if the application is integrated into a larger network infrastructure.\nGiven that the exploit is public and the project has not addressed the reported issue, there is no technical barrier preventing an attacker from automating the discovery and exploitation of vulnerable instances. There is no requirement for sophisticated bypass techniques, as the authentication barrier is essentially non-existent for instances utilizing the default configuration provided by the vulnerable aca.sql file."
}