Stud.IP Multiple SQL Injection Vulnerabilities (CVE-2026-51346) Analysis and Reproduction

Vulnerability Overview CVE ID: CVE-2026-51346 Vulnerability Type: Multiple SQL Injection Vulnerabilities Discovery Date: 2026-04-12 Report Date: 2026-04-13 Confirmation Date: 2026-04-21 Fix Date: 2026-04-22 Public Disclosure Date: 2026-08-17 Scope of Impact Affected System: Stud.IP (a learning management system widely deployed at multiple German universities) Affected Versions: v6.0.3 and all versions prior to v5.4.12 Required Attacker Privileges: Authenticated user privileges (Instructor or Administrator) Potential Impact: - Extraction of the entire database (including password hashes, private messages, and student grades) - Execution of Denial of Service (DoS) attacks Remediation Fixed Versions: v6.0.3 and v5.4.12 Remediation Measure: Use parameterized queries instead of directly concatenating user input into SQL statements Vulnerability Description Affected Classes: - ( ) - ( ) - ( ) - ( ) Root Cause: The method in these classes passes or other user-controlled values to the built-in function via string interpolation, leading to SQL injection. Example Code Reproduction Method Tool: Targets: - Injection via in - Injection via the variable in the function of Example Commands Impact Data Leakage: - Student grades and academic records - Password hashes for all users - Private messages between students and staff - Personal information (names, email addresses) Data Deletion: Data can be deleted from certain tables Denial of Service: Denial of Service attacks can be executed against the MySQL database References Patch Release Notes CVE-2026-51346 CWE-89: SQL Injection OWASP SQL Injection Prevention Cheat Sheet

Goal Reached Thanks to every supporter — we hit 100%!

Stud.IP Multiple SQL Injection Vulnerabilities (CVE-2026-51346) Analysis and Reproduction