Description

A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T04:17:55.277Z",
  "pubdate": "2026-09-07T04:17:55.277Z",
  "executiveSummary": "A critical SQL injection (SQLi) vulnerability has been identified in the itsourcecode School Management System version 1.0.\nThe vulnerability resides within the User_Login.php script, specifically affecting the email parameter.\nThis flaw permits remote, unauthenticated attackers to inject malicious SQL commands into database queries, potentially leading to unauthorized data access, modification, or deletion.\nAs a public exploit is available, the risk to deployments of this software is high.\nSuccessful exploitation allows attackers to bypass authentication mechanisms, extract sensitive administrative credentials, or manipulate the backend database content without requiring prior system access.",
  "technicalDetails": "The vulnerability originates from improper input sanitization of the email parameter within the User_Login.php file. The application fails to adequately neutralize user-supplied input before incorporating it into a database query string.\nThe attack flow commences with the attacker crafting a malicious HTTP POST or GET request directed at the User_Login.php endpoint. By injecting SQL syntax (such as union-based or boolean-based payloads) into the email argument, the attacker can manipulate the structure of the backend SQL query.\nBecause the input is concatenated directly into the query, the database interpreter executes the injected command as part of the intended SQL statement rather than treating the input as literal data. This effectively alters the logic of the authentication routine.\nIn a typical attack scenario, an attacker might bypass password verification by injecting a tautology (e.g., ' OR '1'='1') to force the query to return a 'true' condition, granting access to the application without valid credentials. Furthermore, through union-based SQL injection techniques, the attacker can extract data from other tables within the database schema, including password hashes, user metadata, or configuration settings.\nThis vulnerability is classified as a remote, unauthenticated attack, as the injection point occurs during the login process before any session context is established. The lack of parameterized queries or prepared statements in the affected component facilitates this persistent security weakness.\nThe post-exploitation impact is severe, potentially resulting in complete compromise of the School Management System, unauthorized access to sensitive student or faculty information, and significant loss of data integrity."
}