ProjectsAndPrograms School Management System SQL Injection Vulnerability in select-students.php

A SQL injection vulnerability has been identified in ProjectsAndPrograms School Management System version 1.0. The issue arises in the file owner_panel/fetch-data/select-students.php, where the argument select is manipulated, allowing for remote exploitation. This vulnerability stems from inadequate validation of user input, enabling attackers to inject malicious SQL queries that could bypass authentication, access or alter sensitive database information, and execute database management tasks.

Impact

Exploitation of this vulnerability allows for SQL injection, where attackers can manipulate database queries. This could lead to unauthorized data access, data modification, or execution of administrative database operations.

Reproduction

The vulnerability can be reproduced by sending a request to owner_panel/fetch-data/select-students.php with a crafted 'select' argument that includes malicious SQL code. This input is not properly sanitized, allowing the injected SQL to be executed by the database.