SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to…

Medium CVSS 6.5

CVECVE-2025-66947

First seen2026-10-14 16:30 UTC

Disclosed2025-12-26 15:15 UTC

Last updated2026-10-14 16:30 UTC

Channel statusauto

Summary

SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Sources

NVD DATABASE

Original Links

https://github.com/kabir0104k/CVE-2025-66947/blob/main/README.md Exploit

Timeline

2026-10-14 nvd_ingest NVD