S
QL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.
References
| Link | Resource |
|---|---|
| https://github.com/kabir0104k/CVE-2025-66947/blob/main/README.md | Exploit Third Party Advisory |
Configurations
History
31 Dec 2025, 14:54
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Krishanmurariji student Management System
Krishanmurariji |
|
| References | () https://github.com/kabir0104k/CVE-2025-66947/blob/main/README.md - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:krishanmurariji:student_management_system:1.0:*:*:*:*:*:*:* |
26 Dec 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | CWE-89 |
26 Dec 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-26 15:15
Updated : 2025-12-31 14:54
NVD link : CVE-2025-66947
Mitre link : CVE-2025-66947
CVE.ORG link : CVE-2025-66947
JSON object : View
Products Affected
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')