Executive Summary

The vulnerability CVE-2026-10226 exists in the delete.php file of the raisulislamg4 student_management_system_by_php. It allows an attacker to delete arbitrary records such as users, courses, teachers, students, or applications without any authentication or authorization.

This happens because the delete.php script does not check if the requester is logged in or has permission to delete records. Additionally, the script constructs SQL queries by directly concatenating unsanitized GET parameters, which leads to SQL injection.

An attacker can exploit this by crafting a URL with parameters like user_id, course_id, teacher_id, student_id, or application_id to delete records remotely and without authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized deletion of important records such as user accounts, courses, teachers, students, or applications.

Because the vulnerability allows remote exploitation without authentication, an attacker can manipulate or destroy data, potentially causing data loss, disruption of service, and compromising the integrity of the system.

The SQL injection aspect also increases the risk of further database compromise or data leakage.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the delete.php endpoint for unauthorized record deletion and SQL injection via URL parameters such as user_id, course_id, teacher_id, student_id, or application_id.

• Send HTTP requests to the delete.php script with various parameters to check if records can be deleted without authentication, for example: curl -i "http://<target>/delete.php?user_id=1"
• Attempt SQL injection payloads in the parameters to see if the backend database responds with errors or unexpected behavior, e.g., curl -i "http://<target>/delete.php?user_id=1' OR '1'='1"
• Monitor network traffic for suspicious requests targeting delete.php with parameters that could indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the delete.php endpoint to authenticated and authorized users only.

Implement proper input validation and parameter sanitization to prevent SQL injection attacks.

If possible, apply web application firewall (WAF) rules to block malicious requests targeting the vulnerable parameters.

Monitor logs for unauthorized deletion attempts and unusual activity related to delete.php.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated arbitrary deletion of records and SQL injection in the student management system, which can lead to unauthorized access, modification, or deletion of sensitive data.

Such unauthorized data manipulation and potential data breaches can negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls over data access, integrity, and confidentiality.

Specifically, the lack of authentication and authorization combined with SQL injection risks could lead to exposure or loss of personal data, violating principles of data security and privacy mandated by these standards.

Useful 0 Not Useful 0