SQL Injection Vulnerability in College Management System v1.0

1. Technical Summary

College Management System v1.0 contains a high-severity SQL injection vulnerability via the `course_code` parameter. Insufficient input sanitization and lack of prepared statements allow an attacker with low-privileged access to inject arbitrary SQL syntax into backend database queries.

2. Vulnerability Mechanics

• ›User input submitted via the `course_code` parameter is incorporated directly into an SQL query without parameterization.
• ›An attacker can append crafted SQL clauses to bypass query logic and interrogate the underlying relational database.
• ›Evaluated under CVSS v3.1 (`AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`), successful exploitation compromises the confidentiality, integrity, and availability of the application database.

3. Potential Business & Technical Impact

• Confidentiality (High): Unauthorized extraction of student, faculty, administrative, and credential records from the database.
• Integrity (High): Unauthorized modification of academic records, user accounts, or administrative permissions.
• Availability (High): Potential corruption or deletion of database records affecting institutional operations.

4. Defensive Remediation Considerations

• Refactor all database queries handling `course_code` and adjacent parameters to use parameterized prepared statements (`PDO` or `mysqli` bound parameters).
• Validate `course_code` against a strict alphanumeric format pattern prior to database interaction.
• Ensure database accounts used by the web application operate with least-privilege table permissions.