CVE-2026-3410

Plain English Summary

AI-powered analysis for quick understanding

This vulnerability allows an attacker to execute SQL injection attacks remotely by manipulating the student_id parameter in a specific admin file of the society management system. If successfully exploited, the attacker could gain unauthorized access to the database, potentially exposing sensitive information.

Technical Description

A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/check_studid.php. Executing a manipulation of the argument student_id can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVSS Vector Analysis

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
Confidentiality ImpactHigh
Integrity ImpactHigh
Availability ImpactHigh
ScopeChanged

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploit Resources

Search for proof-of-concept code and exploit modules

Official References

Est. Bounty
$1,000($500-$1K)
Vendor Response
Grade APatched in 1 day

Quick Information

Published

Mar 2, 2026

about 1 month ago

Last Modified

Mar 3, 2026

about 1 month ago

Vendor

angeljudesuarez

Product

society management system

Related Vulnerabilities

CVE-2026-3944Medium

An attacker can exploit a vulnerability in the university management system to manipulate a specific input, allowing them to execute unauthorized SQL commands and potentially access or modify the database remotely. This attack can be carried out without needing physical access to the system, making it a significant risk for any installation of this software.

CVE-2026-3812Medium

This vulnerability allows an attacker to inject malicious scripts into the payroll management system, potentially compromising user data or session information. It can be exploited remotely by manipulating a specific part of the web application without needing special access or credentials.

CVE-2026-3765Medium

This vulnerability allows an attacker to remotely manipulate the university management system's database by exploiting a flaw in a specific file, which can lead to unauthorized access to sensitive information. The attacker needs to send a specially crafted request to the system, and there are publicly available tools that can facilitate this exploit.

CVE-2026-3760Medium

An attacker can remotely manipulate a specific part of the university management system to execute unauthorized SQL commands, potentially gaining access to sensitive data in the database. This vulnerability occurs when the system processes a certain input incorrectly, making it easy for attackers to exploit it if they know how to send the right request.

CVE-2026-3747Medium

An attacker can exploit a vulnerability in the university management system to manipulate data in the database by sending specially crafted requests, allowing them to execute unauthorized SQL commands. This can be done remotely without needing to be logged in, and there are publicly available methods to carry out the attack.