CVE-2026-78056: sambitraj Student-Management-System Dashboard sql injection
A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is some unknown functionality of the component Dashboard. The manipulation of the argument rollno/teachername results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Since the issue allows remote SQL injection via the Dashboard parameters roll_no/teacher_name, place a compensating network control to restrict access to the Dashboard over the network (e.g., limit inbound access to trusted IPs only) until the underlying code fix is applied.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be executed remotely, but the severity vector indicates low privileges are required. No user interaction is required.
Which inputs are implicated?
The SQL injection is associated with the roll_no and teacher_name arguments in the Dashboard component.
Is a public exploit available?
Yes. The available information states that an exploit is public and may be used.
How can I determine whether my deployment is affected?
The issue affects Student-Management-System revisions up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Because the project uses a rolling release model, affected or fixed release version numbers are not available.
Is there a vendor response or confirmed fix?
The project was notified through an issue report but had not responded at the time of publication. No fixed version or vendor-provided remediation is identified in the available information.