CVE-2026-119619
Received Received - Intake

SQL Injection in cak-filemanagement-system

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulDB

Description
A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_student.php. Performing a manipulation of the argument date/department/subject/forwarded_to/action_taken_by/section/password results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119619
EUVD
EUVD-2026-114257

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
37954679 cak-filemanagement-system 5e6433246475e66462e1fea980688de96a049297

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an SQL injection flaw in the cak-filemanagement-system up to version 5e6433246475e66462e1fea980688de96a049297. It exists in the mysqli_query function of the admin/save_student.php file. Attackers can manipulate input fields like date, department, subject, forwarded_to, action_taken_by, section, or password to inject malicious SQL code. The exploit is possible remotely and has been publicly disclosed.

Detection Guidance

To detect this SQL injection vulnerability in the cak-filemanagement-system, inspect the admin/save_student.php file for improper input validation in the mysqli_query function. Check for unsanitized user inputs in parameters like date, department, subject, forwarded_to, action_taken_by, section, or password. Use tools like SQLMap to test for SQL injection flaws by sending crafted payloads to these parameters.

Impact Analysis

This vulnerability could allow attackers to execute unauthorized SQL commands on the database. This may lead to unauthorized data access, modification, or deletion. Sensitive information like user credentials or system data could be exposed or altered. The remote attack vector increases the risk as it doesn't require local access.

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA by exposing or altering sensitive personal data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit could result in data breaches, leading to legal penalties, fines, and reputational damage for organizations handling regulated data.

Mitigation Strategies

Immediately update the cak-filemanagement-system to the latest version if available. If no patch exists, disable the affected admin/save_student.php functionality or restrict access to it. Implement strict input validation and use prepared statements for all database queries. Monitor network traffic for suspicious SQL injection attempts targeting these parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119619. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart