---
id: CVE-2025-66947
title: >-
  SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the
  /studentms/admin/edit-class-detail.php via the editid GET parameter
summary: >-
  SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the
  /studentms/admin/edit-class-detail.php via the editid GET parameter. An
  attacker can trigger controlled delays using SQL SLEEP() to infer database
  contents. Successful e…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-89
vendor: krishanmurariji
product: student_management_system
affected:
  - student_management_system = 1.0
published: '2025-12-26'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:10:00.250'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66947'
references:
  - url: 'https://github.com/kabir0104k/CVE-2025-66947/blob/main/README.md'
    label: cve@mitre.org
tags:
  - nvd
  - exploit-available
epss: 0.00281
epssPercentile: 0.19075
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/kabir0104k/CVE-2025-66947'
  checkedAt: '2026-10-14T16:41:07.236Z'
exploitAvailable: true
ingestedAt: '2026-10-14T16:40:32.059Z'
---

## Overview

SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.

## Affected

- `student_management_system = 1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.