VulnerabilityPublished 1 Jul 2021Updated 28 May 2025

CVE-2021-28423: Teachers Record Management System · Multiple SQL Injection

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 14:05 UTC

Severity

High

Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 2.5% chance of exploitation in 30 days – higher than 85% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 1 Jul 2021
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
n/a n/a	Affected >=1.0 <=2.1	Fixed in–

AI-suggested

To mitigate this vulnerability, European organizations using the Teachers Record Management System should first verify if vendor patches or updates are available and apply them promptly. In the absence of official patches, organizations should implement input validation and parameterized queries (prepared statements) to sanitize all user inputs, particularly the 'editid' GET parameter and the 'searchdata' POST parameter. Conduct a thorough code review and penetration testing focused on SQL Injection vectors within the application. Employ Web Application Firewalls (WAFs) configured to detect and block SQL Injection attempts targeting these parameters. Limit user privileges strictly on a need-to-access basis to reduce the risk from authenticated users. Monitor logs for unusual database queries or errors indicative of injection attempts. Additionally, implement multi-factor authentication (MFA) to reduce the risk of credential compromise. Regularly back up databases and ensure backups are secure to enable recovery in case of data tampering. Finally, provide security awareness training to users to recognize phishing or social engineering attempts that could lead to credential theft.

Description

Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated users to execute arbitrary SQL commands via the 'editid' GET parameter in edit-subjects-detail.php, edit-teacher-detail.php, or the 'searchdata' POST parameter in search.php.

Impact

For European organizations, especially educational institutions or government bodies managing teacher records, this vulnerability poses a significant risk. Exploitation could lead to unauthorized disclosure of sensitive personal data such as teacher identities, qualifications, schedules, and potentially student-related information if stored in the same system. Data integrity could also be compromised, allowing attackers to alter records, which may disrupt administrative processes or lead to misinformation. The requirement for authentication limits the attack surface to insiders or users with valid credentials, but this does not eliminate the risk, as insider threats or compromised accounts could be leveraged. Additionally, successful exploitation could enable attackers to escalate privileges or pivot to other systems within the network, increasing the overall impact. Given the critical nature of educational data and the regulatory environment in Europe (e.g., GDPR), unauthorized access or data breaches could result in legal penalties, reputational damage, and operational disruptions.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Jul 2025, 05:09 UTC

Technical details

References

Community reviews

Related threats