Description

A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/university.php of the component Search Handler. The manipulation of the argument book_name/book_author results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-06T13:17:10.487Z",
  "pubdate": "2026-09-06T13:17:10.487Z",
  "executiveSummary": "A critical SQL injection vulnerability exists within the Search Handler component of Mstfakts College-Management-System, specifically residing in the Front-end/university.php file. This flaw allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL statements through the book_name or book_author parameters.\nThe vulnerability stems from improper sanitization of user-supplied input before it is passed to the mysqli_query function. Successful exploitation grants an attacker the ability to bypass security controls, potentially leading to unauthorized data exfiltration, database modification, or complete compromise of the underlying backend database. Given that the exploit code is publicly available and the vendor has not provided a patch, the risk profile for this vulnerability is high. Users of the system remain exposed to remote attacks as the software's rolling release model lacks specific version identifiers to track remediation status.",
  "technicalDetails": "The vulnerability is localized within the Front-end/university.php file, which serves as the search interface for the application. The root cause is the insecure implementation of the mysqli_query function, which executes database operations using unsanitized input derived directly from HTTP GET or POST request arguments. Specifically, the 'book_name' and 'book_author' parameters are concatenated directly into a SQL string without the use of prepared statements or parameterized queries.\nThe attack flow commences when an attacker identifies the search functionality as an entry point. By submitting a crafted payload containing SQL syntax characters (such as single quotes, comments, or union operators) into the 'book_name' or 'book_author' fields, the attacker can manipulate the structure of the backend SQL query. For instance, an attacker might inject ' OR 1=1 --' to bypass search filters or use 'UNION SELECT' statements to exfiltrate sensitive data from other tables within the database schema.\nSince the application utilizes the mysqli_query function without input validation or output encoding, the database engine interprets the malicious input as a valid command. The vulnerability is exploitable remotely, requiring no prior authentication or administrative privileges. The network exposure is limited only by the reachability of the web server hosting the College-Management-System.\nThe post-exploitation impact is severe, as the application's database service account typically possesses sufficient privileges to read, update, or delete records across the database. An attacker could extract administrative credentials, drop tables, or perform reconnaissance to map the entire database structure. Because the project is maintained via a rolling release system and the developers have not addressed the reported issue, the vulnerability remains persistent and easily exploitable using widely available public exploit scripts."
}