CVE-2026-105919: SQL Injection in Kusalkasilva Learning-Management-System

The Kusalkasilva Learning-Management-System contains a SQL injection vulnerability in the Administrator Login Endpoint, specifically in the mysql_query function within admin/login.php. By manipulating the username and password arguments, an attacker can perform SQL injection remotely without authentication or user interaction. The vulnerability is tracked as CVE-2026-105919 with a CVSS 3.1 base score of 7.3, indicating a medium severity. The product lacks versioning, so no specific affected versions are available. The vulnerability was responsibly disclosed to the project, which has not yet issued a fix or response. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data disclosure, data modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the system. Since the attack can be launched remotely without authentication, the attack surface is broad. However, no confirmed in-the-wild exploitation has been reported.

No official fix or patch is currently available as the project has not responded to the issue report. Users should apply compensating controls such as restricting access to the admin login endpoint, using web application firewalls to detect and block SQL injection attempts, and monitoring for suspicious activity. Check the vendor or project repository regularly for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.