CVE-2026-86673: ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqliconnect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the application so the vulnerable function in config/database.php (mysqli_connect with hard-coded credentials) cannot be reached remotely.
- Operational
Rotate any hard-coded database credentials used by ningzichun Student Management System in config/database.php, since the vulnerability description states this manipulation causes hard-coded credentials.
Event History
Frequently Asked Questions
Can this be exploited without an account or user interaction?
Yes. The supplied vector indicates network access, low attack complexity, no privileges required, and no user interaction required.
Is exploit information publicly available?
Yes. The exploit has been publicly disclosed and may be usable by attackers.
Which releases should be considered affected?
The issue affects the project through commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Because the project uses a rolling release model, specific affected or fixed release versions are not available.
Has the project provided a fix or response?
The project was notified through an issue report but had not responded at the time of publication. No fixed release is identified in the available information.