CVE-2026-82620: Soarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course_ranking sql injection
A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseDao.courseranking of the file code/src/dao/CourseDao.java. Performing a manipulation of the argument cno results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable and requires low privileges. No user interaction is required, but the attacker must be able to supply a crafted cno argument to the affected CourseDao.course_ranking function.
Which versions are affected?
Soarkey StudentManagement and 学生信息管理系统 are reported affected through commit e08f7f1d5015af407aa4cca0ada3dea189b4937e. No fixed version is identified in the available information.
Is public exploit code available?
Yes. The exploit has been publicly released, increasing the likelihood that attackers may attempt exploitation.
What should be prioritized if a patch is not available?
Restrict access to the functionality that reaches CourseDao.course_ranking and prevent untrusted users from controlling the cno argument. Review application and database activity for suspicious requests involving that parameter.