CVE-2026-105919: SQL Injection in Kusalkasilva Learning-Management-System

This vulnerability exists in the Kusalkasilva Learning-Management-System up to commit ffeb873f8803f1e9664384ff75000c7da45466d2. The flaw is in the Administrator Login Endpoint, specifically in the mysql_query function within admin/login.php. By manipulating the username or password arguments, an attacker can perform SQL injection remotely without any privileges or user interaction. The product lacks versioning, so exact affected versions are unknown. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) and has publicly available exploit code. The vendor has not yet issued a patch or advisory.

Successful exploitation allows remote attackers to perform SQL injection attacks via the login interface, potentially leading to unauthorized access or data manipulation. The vulnerability requires no privileges or user interaction, increasing its risk. However, the absence of a vendor response or patch means the system remains vulnerable. The public availability of exploit code heightens the threat.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the login endpoint. Avoid exposing the login interface to untrusted networks if possible.