Executive Summary

This vulnerability is a SQL Injection flaw in the admin login functionality of the imvks786 student_management_system. It occurs in the file admin/admin_login.php where the username (a_usr) and password (a_pwd) inputs are directly used in an SQL query without proper sanitization or parameterization.

An attacker can inject malicious SQL code, such as a boolean-based payload like "admin' OR '1'='1", into the username field. This manipulates the SQL query to always return a valid result, bypassing the password check and granting unauthorized administrative access.

The attack can be performed remotely by submitting the crafted input on the admin login page, leading to a complete authentication bypass.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability is a SQL injection in the administrator login endpoint that allows an attacker to bypass authentication and gain full administrative access remotely.

Such unauthorized access could lead to exposure, modification, or deletion of sensitive personal data managed by the student management system.

This exposure and potential data breach could violate common data protection standards and regulations such as GDPR and HIPAA, which require protection of personal and sensitive information against unauthorized access.

Therefore, the vulnerability negatively impacts compliance by increasing the risk of data breaches and unauthorized data manipulation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to bypass authentication and gain full administrative access to the student management system without valid credentials.

• Unauthorized access to sensitive administrative functions.
• Potential manipulation, deletion, or theft of student records and other critical data.
• Compromise of the integrity and confidentiality of the system.
• Remote exploitation without any user interaction or privileges.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by testing the admin login endpoint for SQL injection by manipulating the username (a_usr) and password (a_pwd) parameters.

A common detection method is to attempt to inject a boolean-based payload such as "admin' OR '1'='1" into the username field and observe if the login is bypassed.

You can use tools like curl or sqlmap to test this remotely.

• Using curl to test the login endpoint: curl -X POST -d "a_usr=admin' OR '1'='1& a_pwd=anypassword" http://target/admin/admin_login.php
• Using sqlmap to test for SQL injection: sqlmap -u "http://target/admin/admin_login.php" --data="a_usr=admin&a_pwd=pass" --risk=3 --level=5 --batch

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include implementing proper input validation and using parameterized queries or prepared statements to prevent SQL injection.

Restricting or disabling the vulnerable admin login endpoint until a patch is available can reduce exposure.

Monitoring access logs for suspicious login attempts with SQL injection payloads is also recommended.

Since the project has not yet responded with a fix, consider applying web application firewall (WAF) rules to block common SQL injection patterns targeting the admin login.

Useful 0 Not Useful 0