CVE-2026-5669 Details

A time-based blind SQL injection vulnerability has been identified in the Cyber-III Student-Management-System in versions prior to 1a938fa61e9f735078e9b291d2e6215b4942af3f. The issue resides in the login.php file within the Parameter Handler component. The vulnerability arises because user-supplied input for the username and password parameters is directly concatenated into the SQL query without proper sanitization or the use of parameterized queries. While the application performs a strict type comparison after retrieving stored credentials—preventing a straightforward login bypass—an attacker can exploit this injection to extract sensitive data from the database using time-based techniques. This vulnerability can be exploited remotely, and a public exploit is available.

The vulnerability can be remediated by using parameterized queries or prepared statements to handle SQL query execution. This approach separates SQL logic from user input, preventing injection attacks. Developers can use MySQLi or PDO with prepared statements as a recommended practice.