Description
A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the component Admin Login. This manipulation of the argument username/password causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Published: 2026-03-31
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Immediate Patch
AI Analysis

Impact

The Student Membership System contains a flaw in its admin login routine that permits an attacker to inject arbitrary SQL statements through unsanitized username or password input. An attacker may craft a login payload that is executed by the underlying database, potentially allowing read, modify or delete operations on sensitive data. This can lead to data compromise or unapproved manipulation of system content, impacting the confidentiality and integrity of the application’s data store.

Affected Systems

The vulnerable component is the admin login page located at /admin/index.php in code-projects Student Membership System version 1.0. The flaw resides in an unidentified function within that file that processes the login credentials.

Risk and Exploitability

The evaluated CVSS score of 6.9 indicates a medium severity level. Exploitation is achievable over the internet through normal web request traffic, and the vulnerability has already been publicly disclosed. No EPSS score is available, and the issue is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on March 31, 2026 at 12:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to a newer, non‑vulnerable release of Student Membership System.
  • Refactor the login handling to use prepared statements or other parameterized query techniques, ensuring that user input is never concatenated directly into SQL.
  • Implement input validation or sanitization logic for the username and password fields to reject or escape characters that could alter query structure.
  • Enforce reasonable limits on the length of the username and password inputs to reduce the likelihood of successful injection attempts.
  • Deploy or configure a Web Application Firewall to detect and block SQL injection patterns, and monitor the application for suspicious login activity.

Generated by OpenCVE AI on March 31, 2026 at 12:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 31 Mar 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 31 Mar 2026 11:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the component Admin Login. This manipulation of the argument username/password causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Title code-projects Student Membership System Admin Login index.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-31T18:03:55.741Z

Reserved: 2026-03-30T22:24:10.906Z

Link: CVE-2026-5198

cve-icon Vulnrichment

Updated: 2026-03-31T14:58:26.756Z

cve-icon NVD

Status : Received

Published: 2026-03-31T12:16:31.530

Modified: 2026-03-31T12:16:31.530

Link: CVE-2026-5198

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-31T19:55:49Z

Weaknesses