Executive brief
SourceCodester School Registration and Fee System is a PHP-based web application for managing school enrollment and payment processing. A SQL injection vulnerability in the payment report feature allows unauthenticated attackers to manipulate database queries through the period parameter, potentially exposing or modifying sensitive student and payment records. This could lead to unauthorized access to student information, financial data tampering, and service disruption.
Technical details
A SQL injection vulnerability exists in the /bilal/normal/pay_report.php file where the period parameter is directly concatenated into SQL queries without proper input validation or prepared statements. The vulnerability is accessible remotely without authentication and can be exploited using time-based blind, boolean-based blind, or UNION-based SQL injection techniques. An attacker can extract sensitive information from the database, modify or delete records, or gain broader system compromise. The advisory recommends implementing prepared statements with parameter binding, strict input validation, and enforcing least-privilege database permissions.
Affected products
- SourceCodester School Registration and Fee System 1.0
Timeline
- 2026-09-13: disclosed