CVE-2024-55270
Published: 17 February 2026
Summary
CVE-2024-55270 is a high-severity SQL Injection (CWE-89) vulnerability in Phpgurukul Student Management System. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-55270 is a SQL injection vulnerability (CWE-89) affecting phpgurukul Student Management System version 1.0. The flaw exists in the studentms/admin/search.php component, where the searchdata parameter fails to properly sanitize user input, allowing malicious SQL queries to be executed. It has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
An attacker with low-privilege authenticated access (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and without requiring user interaction (UI:N). Successful exploitation enables high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), potentially allowing the attacker to extract sensitive data from the database, modify records, or disrupt system operations through arbitrary SQL command execution.
References for this CVE include GitHub repositories at https://github.com/shoaibalam112/CVE-2024-55270, which likely contains proof-of-concept details, and https://github.com/shoaibalam112/Student_Management-System_1.0, providing the affected software source. No vendor advisories or patches are detailed in available information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-55434
Vulnerability details
phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in web app (search.php) directly enables remote exploitation of the application (T1190) and arbitrary database access/manipulation (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation of unsanitized user inputs like the searchdata parameter before database queries.
Mandates identification, reporting, and correction of flaws such as the SQL injection vulnerability in studentms/admin/search.php.
Enforces restrictions on information inputs like searchdata to block malicious SQL payloads through format, length, or type limitations.