Executive brief
The Online Thesis Archiving System, a web application used to manage and store academic research, contains a security flaw that allows authenticated users to access unauthorized database information. By sending specially crafted web requests, an attacker with administrative access could extract sensitive data from the underlying database. This could lead to the exposure of internal system structures or other archived information beyond what the user is permitted to see.
Technical details
A SQL injection vulnerability exists in Sourcecodester Online Thesis Archiving System v1.0 within the 'id' parameter of the /otas/projects_per_department.php page. The application fails to properly neutralize special elements in the SQL command, allowing for Union-based SQL injection. An attacker with high privileges (such as an administrator) can exploit this over the network to execute arbitrary SQL queries and leak database information, such as the database name. The vulnerability was demonstrated using a payload that leverages a single quote to break the SQL syntax and a UNION SELECT statement to retrieve data.
Affected products
- Sourcecodester Online Thesis Archiving System 1.0
Timeline
- 2026-04-13: disclosed: Initial disclosure and CVE assignment
- 2026-04-13: advisory