SQL Injection in PHP Student Management System User Role Parameter

A vulnerability has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. The affected element is an unknown function of the file add_user_check.php of the component User Creation Handler. The manipulation of the argument role leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-10227 represents a critical SQL injection vulnerability in the user creation functionality of a PHP-based student management system. The vulnerability exists in the add_user_check.php file where user-supplied input from the 'role' parameter is insufficiently sanitized before being incorporated into SQL queries. This flaw allows remote attackers to execute arbitrary SQL commands without authentication, potentially leading to unauthorized data access, modification, or deletion of student records and administrative credentials. Organizations deploying this open-source student management system—particularly educational institutions managing enrollment and user administration—face immediate risk of data breach and operational disruption.

Casky's Claude-powered skill detection maps this vulnerability across 301 relevant security techniques, with primary focus on MITRE ATT&CK TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would observe detection patterns identifying suspicious SQL syntax in web request payloads targeting add_user_check.php, anomalous role parameter encoding attempts (common SQL injection obfuscation), and database query patterns deviating from legitimate user creation workflows. The platform's extended reasoning capabilities correlate these indicators with CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection) signatures, surfacing attack chains that begin with reconnaissance of the vulnerable endpoint and progress through exploitation attempts. Security teams gain visibility into both attack preparation and execution phases before data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-10227.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-10227

Casky has 301 skills that investigate the attack patterns behind CVE-2026-10227. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn