{"id":"CVE-2026-119619","kind":"vulnerability","aliases":["CVE-2026-119619"],"related":[],"title":"cak-filemanagement-system: SQL injection in student save page lets attackers query the database","description":"A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_student.php. Performing a manipulation of the argument date/department/subject/forwarded_to/action_taken_by/section/password results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"An SQL injection flaw exists in the admin/save_student.php file of the cak-filemanagement-system project, where the date, department, subject, forwarded_to, action_taken_by, section and password arguments reach a database query unsanitized. A remote attacker can read or change database contents, and a public exploit has been released.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cak-filemanagement-system","fixed":[],"affected":"<= commit 5e6433246475e66462e1fea980688de96a049297","ecosystem":"other"}],"ecosystems":[],"tags":["cak-filemanagement-system","other","php","self-hosted"],"not_affected_if":["endpoint-not-reachable","not-deployed"],"how_to_check":"- Check whether your deployment includes `admin/save_student.php` from the cak-filemanagement-system project.\n- Confirm the project version against the affected commit `5e6433246475e66462e1fea980688de96a049297` or earlier.","fix":null,"status":"open","published_at":"2026-10-30T18:17:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","triaged_at":"2026-10-30T18:56:48+00:00","updated_at":"2026-10-30T18:59:50+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-30T18:56:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"cak-filemanagement-system: SQL injection in student save page lets attackers query the database","impact":"high","summary":"An SQL injection flaw exists in the admin/save_student.php file of the cak-filemanagement-system project, where the date, department, subject, forwarded_to, action_taken_by, section and password arguments reach a database query unsanitized. A remote attacker can read or change database contents, and a public exploit has been released.","audience":"businesses","category":"other","nicknames":[],"who_cares":["cak-filemanagement-system","php","self-hosted"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"attacker reads or alters database contents remotely","analyst_note":"Sources say the project has not responded and no fix exists; confirm whether the admin endpoint requires authentication at https://nvd.nist.gov/vuln/detail/CVE-2026-119619.","how_to_check":"- Check whether your deployment includes `admin/save_student.php` from the cak-filemanagement-system project.\n- Confirm the project version against the affected commit `5e6433246475e66462e1fea980688de96a049297` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["not-deployed","endpoint-not-reachable"],"who_is_affected":"Teams that run the cak-filemanagement-system project in a web-reachable deployment are exposed through the admin save_student.php endpoint. The sources state the project has not responded to the report, so no patched version is named. Installations that do not run this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4199,"output_tokens":585,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources say the project has not responded and no fix exists; confirm whether the admin endpoint requires authentication at https://nvd.nist.gov/vuln/detail/CVE-2026-119619.","search":"'-119619':18A,21A '-2026':17A,20A '37954679':91C '5e6433246475':98C 'action':58B 'admin/save_student.php':42B,109C 'affect':101C 'argument':64B,115C 'attack':12A,72B,122C 'cak':2A,23A,27B,47B,93C 'cak-filemanagement-system':1A,22A,26B,46B,92C 'carri':127C 'chang':76B 'content':78B 'could':137C 'cve':16A,19A 'databas':15A,67B,77B 'date':53B 'date/department/subject/forwarded_to/action_taken_by/section/password':116C 'depart':54B 'e66462e1fea980688de96a049297':99C 'earli':147C 'exist':39B 'exploit':82B,131C 'file':43B,108C 'filemanag':3A,28B,48B,94C 'filemanagement':24A 'flaw':38B 'forward':56B 'found':89C 'function':103C 'host':34B 'inform':143C 'inject':6A,37B,120C 'issu':150C 'let':11A 'made':134C 'manipul':112C 'mysqli':104C 'page':10A 'password':63B 'perform':110C 'php':31B 'possibl':124C 'problem':146C 'project':50B,141C 'public':81B,135C 'queri':13A,68B,105C 'reach':65B 'read':74B 'releas':85B 'remot':71B,129C 'report':151C 'respond':155C 'result':117C 'save':9A 'section':61B 'self':33B 'self-host':32B 'sql':5A,36B,119C 'student':8A 'subject':55B 'system':4A,25A,29B,49B,95C 'taken':59B 'unsanit':69B 'use':139C 'vulner':87C 'yet':156C","nicknames":[],"mitigations":[],"who_affected":"Teams running the 37954679 cak-filemanagement-system PHP project (a small GitHub project, no releases) on a web-reachable server are exposed through admin/save_student.php, where several form fields reach a SQL query unsanitized. NVD and the CNA rate the attack as remote with no privileges required, but I could not read the project's issue to confirm whether the endpoint needs a login. Anyone not running this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119619","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119619","severity":null,"published_at":"2026-10-30T18:17:26+00:00","modified_at":"2026-10-30T18:17:26+00:00","first_seen_at":"2026-10-30T18:55:29+00:00","fetched_at":"2026-10-30T18:55:29+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119619:1187","url":null,"severity":null,"published_at":"2026-10-30T18:59:50+00:00","modified_at":"2026-10-30T18:59:50+00:00","first_seen_at":"2026-10-30T18:59:50+00:00","fetched_at":"2026-10-30T18:59:50+00:00","note":"Only the NVD record was reachable (page text came back empty; description read from the signal). Did not find the project's issue or any maintainer response, so no fix and no auth confirmation; nothing marked verified. Fix status none rests on the NVD description (project not responding), not a vendor page. Similar save_student.php bugs in other student-management PHP apps are different products. Could settle by reading the GitHub issue linked from the NVD references."}],"documents":[{"id":25345,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119619","title":"NVD CVE-2026-119619","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}