# CVE-2026-90515: SourceCodester School Registration and Fee System SQL injection in delete_stud.php

Source: https://junglewise.ai/threats/cve-2026-90515-sourcecodester-school-registration-and-fee-system-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-13. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90515 · Severity: high · CVSS 7.3 · Published 2026-09-13

SourceCodester School Registration and Fee System is a web-based application for managing student enrollment and fee collection. A SQL injection vulnerability in the delete student functionality allows unauthenticated attackers to manipulate database queries, potentially exposing, modifying, or deleting sensitive student records and financial data.

Technologies: [SourceCodester School Registration and Fee System](https://junglewise.ai/threats/technologies/school-registration-and-fee-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-90515 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90515 being exploited in the wild.

**How severe is CVE-2026-90515?** High severity, with a CVSS score of 7.3, published 13 September 2026.

**Which products and versions are affected?** SourceCodester School Registration and Fee System 1.0.

**Is there a fix for CVE-2026-90515?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90515 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90515?** Check whether you run SourceCodester School Registration and Fee System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A time-based blind SQL injection vulnerability exists in the /bilal/normal/delete_stud.php file where the 'selector[]' POST parameter is passed directly into SQL queries without sanitization or parameterized statements. The vulnerability is remotely exploitable without authentication or user interaction. An attacker can inject malicious SQL via crafted POST requests (e.g., selector[]=3' AND (SELECT 2083 FROM (SELECT(SLEEP(5)))BJmC)-- CwHZ) to extract database contents, modify data, or execute arbitrary operations. No patch information is currently available; remediation requires implementing prepared statements with parameter binding, input validation, and principle of least privilege for database credentials.

## Affected products

- SourceCodester School Registration and Fee System 1.0

## Timeline

- 2026-07-31: disclosed: Publicly disclosed on GitHub issue

## References

- [https://github.com/zuojiu567/cve/issues/2](https://github.com/zuojiu567/cve/issues/2)
- [https://vuldb.com/cve/CVE-2026-90515](https://vuldb.com/cve/CVE-2026-90515)

## Related threats

- [SourceCodester School Registration and Fee System SQL injection in save_class.php](https://junglewise.ai/threats/cve-2026-90526-sourcecodester-school-registration-and-fee-system-sql-injection)
- [SourceCodester School Registration and Fee System SQL injection in pay_report.php](https://junglewise.ai/threats/cve-2026-90516-sourcecodester-school-registration-and-fee-system-sql-injection)
- [SourceCodester School Registration and Fee System SQL injection](https://junglewise.ai/threats/cve-2026-90514-sourcecodester-school-registration-and-fee-system-sql-injection)