SQL Injection in PHP Student Management System

A flaw has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. Impacted is an unknown function of the file delete.php. Executing a manipulation of the argument user_id/course_id/teacher_id/student_id/application_id can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-10226 represents a critical SQL injection vulnerability in the raisulislamg4 student_management_system_by_php, affecting the delete.php file where user-supplied input in parameters like user_id, course_id, teacher_id, student_id, and application_id are passed directly into SQL queries without proper sanitization. This vulnerability carries a CVSS score of 7.3 (high) and is particularly dangerous because it allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of sensitive student and institutional records. Organizations and educational institutions deploying this system are at immediate risk, especially given that the exploit has been publicly disclosed and the rolling release model means patches may not be uniformly applied across deployments.

Casky's platform maps this vulnerability to MITRE ATT&CK Reconnaissance (TA0001) and Resource Development (TA0043) techniques, with 301 matching security skills that enable detection of the attack chain. When practitioners run scans through Casky's Claude AI-powered analysis, they would identify indicators such as: suspicious SQL syntax patterns in HTTP parameters (CWE-89), unusual database query structures in application logs, and manipulation attempts on identifier fields. The platform would flag encoding bypass attempts (CWE-74) where attackers obfuscate injection payloads, and surface behavioral anomalies like unexpected database connections or privilege escalation queries. Practitioners would see detailed findings mapping these indicators back to the specific MITRE techniques, allowing security teams to prioritize remediation by identifying which attack phases are most likely to occur and implementing corresponding defensive controls at the application layer.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-10226.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-10226

Casky has 301 skills that investigate the attack patterns behind CVE-2026-10226. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn