Executive brief
SourceCodester School Registration and Fee System is a web-based application for managing student enrollment and fee collection. A SQL injection vulnerability in the delete student functionality allows unauthenticated attackers to manipulate database queries, potentially exposing, modifying, or deleting sensitive student records and financial data.
Technical details
A time-based blind SQL injection vulnerability exists in the /bilal/normal/delete_stud.php file where the 'selector[]' POST parameter is passed directly into SQL queries without sanitization or parameterized statements. The vulnerability is remotely exploitable without authentication or user interaction. An attacker can inject malicious SQL via crafted POST requests (e.g., selector[]=3' AND (SELECT 2083 FROM (SELECT(SLEEP(5)))BJmC)-- CwHZ) to extract database contents, modify data, or execute arbitrary operations. No patch information is currently available; remediation requires implementing prepared statements with parameter binding, input validation, and principle of least privilege for database credentials.
Affected products
- SourceCodester School Registration and Fee System 1.0
Timeline
- 2026-07-31: disclosed: Publicly disclosed on GitHub issue