Executive brief
halex CourseSEL is an online course selection system used by educational institutions. A security flaw allows a logged-in student to perform unauthorized database queries. This could lead to the exposure of sensitive student data, administrative credentials, and the potential for an attacker to gain full control over the application.
Technical details
A SQL injection vulnerability exists in halex CourseSEL (a ThinkPHP 3.2 based application) within the check_sel method of Apps/Index/Controller/IndexController.class.php. The root cause is the improper neutralization of the 'seid' HTTP GET parameter, which is directly concatenated into a SQL query string via the framework's where() method. An attacker with low-level student privileges can exploit this remotely by sending crafted HTTP requests. Successful exploitation via error-based SQL injection techniques allows for the extraction of database schemas and administrative credentials from the cs_user table. As of the advisory date, the vendor has not responded to disclosure attempts, and no official patch is available.
Affected products
- halex CourseSEL up to 1.1.0
Timeline
- 2026-04-05: disclosed: Public disclosure of the vulnerability and exploit details.
- 2026-04-05: advisory: CVE-2026-5537 published.