SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.
References
| Link | Resource |
|---|---|
| https://github.com/kabir0104k/CVE-2025-66947/blob/main/README.md | Exploit Third Party Advisory |
Configurations
History
31 Dec 2025, 14:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/kabir0104k/CVE-2025-66947/blob/main/README.md - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:krishanmurariji:student_management_system:1.0:*:*:*:*:*:*:* | |
| First Time |
Krishanmurariji
Krishanmurariji student Management System |
26 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
26 Dec 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-26 15:15
Updated : 2025-12-31 14:54
NVD link : CVE-2025-66947
Mitre link : CVE-2025-66947
CVE.ORG link : CVE-2025-66947
JSON object : View
Products Affected
krishanmurariji
- student_management_system
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')