SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.
References
| Link | Resource |
|---|---|
| https://github.com/kabir0104k/CVE-2025-66947/blob/main/README.md | Exploit Third Party Advisory |
Configurations
History
No history.
Information
Published : 2025-12-26 15:15
Updated : 2025-12-31 14:54
NVD link : CVE-2025-66947
Mitre link : CVE-2025-66947
CVE.ORG link : CVE-2025-66947
JSON object : View
Products Affected
krishanmurariji
- student_management_system
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')