Executive brief
The CASAP Automated Enrollment System, a software used for managing student registrations, contains a security flaw that allows unauthorized access to its database. By sending a specially crafted request to the system's class update feature, an attacker could view sensitive information stored in the database. This could lead to the exposure of student records, administrative credentials, or other private institutional data.
Technical details
A SQL injection vulnerability exists in Sourcecodester CASAP Automated Enrollment System 1.0 within the 'update_class.php' component. The application fails to properly sanitize the 'class_name' parameter before using it in a database query. An unauthenticated remote attacker can exploit this by sending a malicious HTTP request containing SQL commands. Successful exploitation allows the attacker to perform unauthorized data retrieval (OOB or error-based) from the underlying database, potentially compromising the entire enrollment system's data integrity and confidentiality.
Affected products
- Sourcecodester CASAP Automated Enrollment System 1.0
Timeline
- 2026-07-29: disclosed: Initial vulnerability disclosure and CVE assignment