{"id":"CVE-2026-121524","kind":"vulnerability","aliases":["CVE-2026-121524"],"related":[],"title":"School-Management-System: SQL injection through the public search email field","description":"A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d7. Affected by this issue is some unknown functionality of the file parent_Login.php of the component Public Search Feature. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A school management web app's public search feature passes the email parameter of parent_Login.php into a SQL query without proper escaping. A remote attacker can read or change the underlying database, and a public exploit has been published.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"School-Management-System","fixed":[],"affected":"<= d946d649c7c95e101fc5679ecd91999533bb10d7 (rolling release, no versions)","ecosystem":"github"}],"ecosystems":[],"tags":["no-fix","package","php","school-management-system","self-hosted"],"not_affected_if":["no-public-access","not-deployed"],"how_to_check":"- Look for parent_Login.php in your deployed sumiie24/School-Management-System code (a small PHP/MySQL student project; the repo says code is for the Parent module only).\n- Compare your checkout to commit d946d649c7c95e101fc5679ecd91999533bb10d7; the CVE is for that commit and earlier, with no release versions. A newer commit is not confirmed safe.\n- Review how parent_Login.php builds its SQL from the email parameter.","fix":null,"status":"open","published_at":"2026-11-03T22:19:46+00:00","first_seen_at":"2026-11-03T23:15:09+00:00","triaged_at":"2026-11-03T23:16:05+00:00","updated_at":"2026-11-03T23:17:22+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-03T23:16:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"School-Management-System: SQL injection through the public search email field","impact":"high","summary":"A school management web app's public search feature passes the email parameter of parent_Login.php into a SQL query without proper escaping. A remote attacker can read or change the underlying database, and a public exploit has been published.","audience":"businesses","category":"package","nicknames":[],"who_cares":["school-management-system","php","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker reads or alters the school database via SQL injection","analyst_note":"Confirm whether any fixed version or patched commit exists upstream at the NVD entry, and whether the vendor has responded since disclosure.","how_to_check":"- Look for a file named `parent_Login.php` in the deployed School-Management-System code.\n- Check whether the deployment is at or before commit `d946d649c7c95e101fc5679ecd91999533bb10d7`; the sources do not give a release version.","plain_action":"","needs_analyst":true,"not_affected_if":["not-deployed","no-public-access"],"who_is_affected":"Schools or organisations that run the sumiie24 School-Management-System web application with its public search feature exposed. The sources say the product is a rolling release with no version information, and that the vendor did not respond to disclosure, so no fixed version is known. Installations not serving this code path from the internet are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000689,"input_tokens":4228,"output_tokens":533,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether any fixed version or patched commit exists upstream at the NVD entry, and whether the vendor has responded since disclosure.","search":"'-121524':15A,18A '-2026':14A,17A 'affect':88C,150C 'app':39B 'argument':111C 'attack':59B,119C 'chang':63B 'compon':102C 'contact':160C 'continu':142C 'cve':13A,16A 'd946d649c7c95e101fc5679ecd91999533bb10d7':87C 'databas':66B 'deliveri':143C 'disclos':156C 'disclosur':164C 'earli':161C 'email':11A,46B,112C 'escap':56B 'execut':106C 'exploit':70B,126C 'featur':43B,105C 'field':12A 'file':98C 'fix':25B 'flaw':75C 'found':78C 'function':95C 'host':34B 'inform':148C 'inject':6A,117C 'issu':91C 'lead':114C 'manag':3A,30B,37B,83C 'management':21A 'manipul':108C 'may':120C,131C 'no-fix':23B 'packag':26B 'paramet':47B 'parent_login.php':49B,99C 'pass':44B 'perform':122C 'php':27B 'product':135C 'proper':55B 'public':9A,41B,69B,103C 'publish':73B,129C 'queri':53B 'read':61B 'releas':139C,153C 'remot':58B,124C 'respond':168C 'roll':138C 'school':2A,20A,29B,36B,82C 'school-management-system':1A,19A,28B,81C 'search':10A,42B,104C 'self':33B 'self-host':32B 'sql':5A,52B,116C 'sumiie24':80C 'system':4A,22A,31B,84C,140C 'under':65B 'unknown':94C 'updat':152C 'use':133C 'util':136C 'vendor':158C 'version':147C 'way':171C 'web':38B 'without':54B","nicknames":[],"mitigations":[],"who_affected":"Schools or organisations that run the sumiie24 School-Management-System web application with its public search feature exposed. The sources say the product is a rolling release with no version information, and that the vendor did not respond to disclosure, so no fixed version is known. Installations not serving this code path from the internet are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["schoolmanagementsystem"],"ptokens":["management","school","system"],"labels":["high","nofix","package","php","schoolmanagementsystem","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T22:19:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121524","severity":null,"published_at":"2026-11-03T22:19:46+00:00","modified_at":"2026-11-03T22:19:46+00:00","first_seen_at":"2026-11-03T23:15:09+00:00","fetched_at":"2026-11-03T23:15:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121524:1574","url":null,"severity":null,"published_at":"2026-11-03T23:17:22+00:00","modified_at":"2026-11-03T23:17:22+00:00","first_seen_at":"2026-11-03T23:17:22+00:00","fetched_at":"2026-11-03T23:17:22+00:00","note":"Repo shows no fix, advisory, or issue about this CVE; the CVE text (VulDB) says the vendor did not respond and no remediation is listed (OpenCVE). The public exploit link was not found, so poc_count stays 0. No fix; the fix status is based on the absence of a fix and a vendor statement, not on a vendor page, so nothing is marked verified."}],"documents":[{"id":61475,"url":"https://github.com/sumiie24/School-Management-System","title":"sumiie24/School-Management-System repository","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":61476,"url":"https://app.opencve.io/cve/CVE-2026-121524","title":"OpenCVE CVE-2026-121524 (VulDB text, no remediation)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}