CVE-2026-10110: code-projects Student Details Management System index.php sql injection

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Remove

   Remove code-projects Student Details Management System 1.0 from your environment.

   If the application is not required, uninstall or remove the Student Details Management System instance (take the site offline) until a secure, patched version is available.

2. Configuration

   Modify /index.php to stop interpolating the 'roll' parameter into SQL. Use parameterized queries (prepared statements) for all database access and enforce strict validation/sanitization of the 'roll' parameter (e.g., allow only expected numeric or fixed-format values).

   code-projects Student Details Management System (index.php) roll parameter handling = use prepared statements and strict input validation
3. Compensating control

   Deploy WAF or application-layer filters to block SQL injection patterns targeting the 'roll' parameter, restrict access to the vulnerable endpoint to trusted IPs where possible, and apply rate-limiting and monitoring on requests to /index.php.

4. Operational

   Assume possible exploitation given public availability of an exploit: review web and database logs for suspicious requests involving the 'roll' parameter, rotate database credentials and any potentially exposed secrets, and review accounts and privileges for signs of compromise.

Event History

Frequently Asked Questions