CVE-2026-9470 Details

A SQL injection vulnerability has been identified in the Yashpokharna2555 Student Management System, specifically in the student_trans.php file. The issue arises in the confirm_logged_in function, where user-supplied POST parameters, including FIRST_NAME, Last_Name, and EMAIL, are directly concatenated into an SQL INSERT statement without proper sanitization or the use of parameterized queries. This vulnerability allows for unauthorized data insertion, including the potential for cross-site scripting (XSS) payloads, into the database. Additionally, the student_trans.php file lacks authentication checks, leaving the endpoint accessible to anyone without a valid session cookie.

To address this vulnerability, implement authentication by including session.php and calling confirm_logged_in() at the beginning of student_trans.php. Additionally, use prepared statements to prevent SQL injection by binding user inputs as parameters in the SQL query. Validate and sanitize all user inputs to remove any potentially harmful content, such as HTML tags.