Executive brief
The SourceCodester Loan Management System, a web application used to manage financial lending operations, contains a security flaw in its loan saving process. An authenticated user can exploit this flaw to execute unauthorized database commands by sending specially crafted requests. This could allow an attacker to extract sensitive information from the database, potentially compromising borrower data and system integrity.
Technical details
A time-based blind SQL injection vulnerability exists in SourceCodester Loan Management System v1.0 within the 'save_loan' action of the ajax.php file. The application fails to adequately sanitize the 'borrower_id' POST parameter before incorporating it into a database query. An authenticated attacker can exploit this by injecting SQL SLEEP() commands to infer database content based on server response delays. This vulnerability allows for unauthorized data exfiltration from the underlying MySQL database. A proof-of-concept using sqlmap has confirmed the vulnerability.
Affected products
- SourceCodester Loan Management System 1.0
Timeline
- 2026-03-31: disclosed: Initial disclosure and CVE assignment
- 2026-03-31: advisory: NVD publication date