CVE-2026-18896

This SQL injection in the password-change function (changepass.php, oldpass parameter) is more dangerous than its CVSS and EPSS scores suggest. The vulnerability sits at a critical junction: it's an authentication-adjacent operation where the application explicitly trusts user input to verify identity before allowing a password change. Compromising this doesn't just expose one account—it potentially grants access to the administrative functions of a system holding student records, grades, and personally identifiable information. The vendor appears unresponsive, which is the decisive factor here. This isn't a patch-pending situation; it's abandoned software with no fix pathway. Public disclosure has already removed any security-through-obscurity buffer. The exploit is available, and the question is no longer whether someone will weaponize it but when. For institutions running this code, treat this as an orphaned vulnerability: no vendor fix is coming, so compensating controls are your only option. Prioritize these actions: First, audit your environment immediately. Student registration systems are frequently deployed in educational institutions with limited IT security resources, making them likely to be running unpatched. Determine whether this code or any derivative fork exists in your infrastructure—you may be running a modified version that no longer matches the original CVE. Second, deploy a WAF rule blocking or sanitizing SQL injection patterns specifically in the oldpass parameter. Generic SQLi rules may miss this vector if it's customized in your fork. Third, examine session context and integration points. This system likely connects to grade databases, financial aid systems, and potentially institutional SSO. A compromise of the oldpass function potentially accesses all of it through the resulting session. Fourth, plan for eventual migration. Abandoned PHP code handling PII should not be a long-term operational asset. The exposure compounds over time as forks proliferate and the codebase ages without security maintenance.

Reviewed through automated stages and approved by a human before publication.