Executive brief
SourceCodester School Registration and Fee System is a PHP-based web application for managing student registration and fee collection. A SQL injection vulnerability in the student data save function allows unauthenticated attackers to manipulate the database, potentially exposing student records, grades, fees, and contact information. An attacker could extract, modify, or delete sensitive educational and financial data without any login credentials.
Technical details
A SQL injection vulnerability exists in the `/bilal/normal/save_stud.php` file where the POST parameter `status` is inserted directly into SQL queries without proper sanitization or prepared statements. The vulnerability is exploitable remotely without authentication or user interaction using time-based blind SQL injection techniques. An attacker can craft malicious payloads in the `status` parameter to execute arbitrary SQL commands, leading to unauthorized database access, data exfiltration, modification, or deletion. The vulnerability is confirmed with publicly available exploits and proof-of-concept code.
Affected products
- SourceCodester School Registration and Fee System 1.0
Timeline
- 2026-07-31: disclosed: Vulnerability reported on GitHub
- 2026-09-13: advisory: CVE-2026-90514 published