# CVE-2026-108974: SourceCodester E-Learning System SQL injection and unrestricted upload in Users.php

Source: https://junglewise.ai/threats/cve-2026-108974-a-vulnerability-was-identified-in-sourcecodester-e-learning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108974 · Severity: high · CVSS 7.3 · Published 2026-10-13

SourceCodester E-Learning System is a web-based learning management platform. An unauthenticated attacker can exploit SQL injection in the user management module to create an admin account, then upload malicious PHP files to execute arbitrary code on the server with root privileges. This allows complete system compromise without any credentials.

Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-108974 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108974 being exploited in the wild.

**How severe is CVE-2026-108974?** High severity, with a CVSS score of 7.3, published 13 October 2026.

**Which products and versions are affected?** SourceCodester E-Learning System 1.0, commit 0cfc03f.

**Is there a fix for CVE-2026-108974?** No fixed version is recorded yet. Implement authentication checks at the top of the dispatch switch to reject unauthenticated requests; use prepared statements with column allowlists for all SQL operations; hash passwords with password_hash() on INSERT and UPDATE; restrict file uploads by MIME type and extension, disable PHP execution in the uploads directory, and randomize uploaded filenames. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108974 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108974?** Check whether you run SourceCodester E-Learning System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Implement authentication checks at the top of the dispatch switch to reject unauthenticated requests; use prepared statements with column allowlists for all SQL operations; hash passwords with password_hash() on INSERT and UPDATE; restrict file uploads by MIME type and extension, disable PHP execution in the uploads directory, and randomize uploaded filenames.

## Technical details

The vulnerability chain consists of two flaws in /classes/Users.php?f=save: (1) SQL injection via the lastname parameter in the raw POST-to-SET query construction (CWE-89), allowing an attacker to inject `password = md5('pwned123')` to create an admin user with a known password; (2) unrestricted file upload via the img parameter (CWE-434) that accepts .php files with no validation, landing in a web-accessible directory. No authentication is enforced on this endpoint (CWE-862). The attacker needs only network access and can chain these to gain unauthenticated remote code execution as root.

## Affected products

- SourceCodester E-Learning System 1.0, commit 0cfc03f

## Timeline

- 2026-09-25: disclosed: Vulnerability discovered and validated in local lab

## References

- [https://tracexlabs.com/releases/elearning-preauth-rce.html](https://tracexlabs.com/releases/elearning-preauth-rce.html)
- [https://vuldb.com/cve/CVE-2026-108974](https://vuldb.com/cve/CVE-2026-108974)