CVE-2026-78056
Received Received - Intake

SQL Injection in Student-Management-System Dashboard

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulDB

Description
A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is some unknown functionality of the component Dashboard. The manipulation of the argument roll_no/teacher_name results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-78056
EUVD
EUVD-2026-64621

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sambitraj student-management-system to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in the STUDENT-MANAGEMENT-SYSTEM application. It affects the dashboard component where user-supplied POST parameters like roll_no and teacher_name are directly concatenated into SQL queries without proper sanitization. This allows attackers to inject malicious SQL code through normal dashboard requests.

Detection Guidance

To detect this SQL injection vulnerability, monitor POST requests to admin_dashboard.php, student_dashboard.php, and teacher_dashboard.php for parameters roll_no and teacher_name. Send test payloads like roll_no=1' AND SLEEP(2)-- and compare response times. Delays indicate potential SQL injection.

Impact Analysis

An attacker could exploit this to extract sensitive database content, enumerate records, probe conditions, or modify data if stacked queries are enabled. Exploitation can be verified by comparing response times between normal requests and those containing SQL injection payloads like SLEEP(2).

Compliance Impact

This SQL injection vulnerability could lead to unauthorized access, modification, or deletion of sensitive student, teacher, or administrative data stored in the system. For GDPR, this may result in violations of data confidentiality and integrity requirements, potentially leading to unauthorized data processing or disclosure. Under HIPAA, if the system handles protected health information, this flaw could expose such data to unauthorized parties, violating security and privacy rules.

Mitigation Strategies

Immediately update to the latest version of STUDENT-MANAGEMENT-SYSTEM if available. If not, implement prepared statements for all SQL queries using roll_no and teacher_name. Validate and sanitize all user inputs before processing. Disable stacked queries if enabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart