CVE-2026-78056: SQL Injection in sambitraj Student-Management-System

The sambitraj Student-Management-System contains a SQL injection vulnerability in the Dashboard component, triggered by manipulation of the roll_no or teacher_name arguments. This allows remote attackers to inject SQL commands due to insufficient input validation or sanitization. The vulnerability affects all versions up to the specified commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The vendor has not issued a response or patch at this time. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited impact on confidentiality, integrity, and availability as per the CVSS vector. No active exploitation in the wild has been reported yet.

No official fix or patch is currently available from the vendor. Since the vendor has not responded to the issue report and no patch links are provided, users should monitor the vendor's communications for updates. Until a fix is released, consider applying input validation or filtering on the roll_no and teacher_name parameters at the application or database level as a temporary mitigation. Avoid exposing the vulnerable Dashboard functionality to untrusted networks if possible.