Executive brief
The CASAP Automated Enrollment System, a software used for managing student registrations, contains a security flaw that allows unauthorized access to its database. By sending specially crafted information during the student saving process, an attacker could view sensitive records, including personal student data. This could lead to a significant data breach and compromise the privacy of enrolled individuals.
Technical details
A SQL injection vulnerability exists in Sourcecodester CASAP Automated Enrollment System 1.0 within the 'save_stud.php' component. The application fails to properly sanitize the 'fname', 'lname', and 'student_class' HTTP POST parameters before using them in a database query. A remote, unauthenticated attacker can exploit this by sending malicious SQL commands to the server. Successful exploitation allows the attacker to bypass authentication, read sensitive data from the database, or potentially modify database records depending on the database configuration.
Affected products
- Sourcecodester CASAP Automated Enrollment System 1.0
Timeline
- 2026-07-29: disclosed: CVE published to NVD