Quick answers
- Is CVE-2026-108974 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-108974 being exploited in the wild.
- How severe is CVE-2026-108974?
- High severity, with a CVSS score of 7.3, published 13 October 2026.
- Which products and versions are affected?
- SourceCodester E-Learning System 1.0, commit 0cfc03f.
- Is there a fix for CVE-2026-108974?
- No fixed version is recorded yet. Implement authentication checks at the top of the dispatch switch to reject unauthenticated requests; use prepared statements with column allowlists for all SQL operations; hash passwords with password_hash() on INSERT and UPDATE; restrict file uploads by MIME type and extension, disable PHP execution in the uploads directory, and randomize uploaded filenames. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-108974 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-108974?
- Check whether you run SourceCodester E-Learning System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Implement authentication checks at the top of the dispatch switch to reject unauthenticated requests; use prepared statements with column allowlists for all SQL operations; hash passwords with password_hash() on INSERT and UPDATE; restrict file uploads by MIME type and extension, disable PHP execution in the uploads directory, and randomize uploaded filenames.
Technical details
The vulnerability chain consists of two flaws in /classes/Users.php?f=save: (1) SQL injection via the lastname parameter in the raw POST-to-SET query construction (CWE-89), allowing an attacker to inject `password = md5('pwned123')` to create an admin user with a known password; (2) unrestricted file upload via the img parameter (CWE-434) that accepts .php files with no validation, landing in a web-accessible directory. No authentication is enforced on this endpoint (CWE-862). The attacker needs only network access and can chain these to gain unauthenticated remote code execution as root.
Affected products
- SourceCodester E-Learning System 1.0, commit 0cfc03f
Timeline
- 2026-09-25: disclosed: Vulnerability discovered and validated in local lab