Executive brief
The Online Thesis Archiving System, a web application for managing academic papers, contains a security flaw that allows unauthorized individuals to access its underlying database. By sending a specially crafted web request, an attacker can bypass security controls to view, modify, or delete sensitive information stored within the system. This could lead to the exposure of private research data, loss of academic records, or unauthorized changes to the archive.
Technical details
A SQL injection vulnerability exists in Sourcecodester Online Thesis Archiving System v1.0 within the '/otas/view_archive.php' file. The application fails to properly sanitize the 'id' GET parameter before using it in a database query. An unauthenticated remote attacker can exploit this by submitting a crafted URL containing SQL syntax (e.g., UNION SELECT statements). Successful exploitation allows the attacker to extract sensitive information from the database, such as user credentials or archived thesis data, and potentially modify or delete database records. The vulnerability is confirmed to exist in environments running PHP 8.1.
Affected products
- Sourcecodester Online Thesis Archiving System 1.0
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory