Executive brief
SourceCodester School Registration and Fee System is a PHP-based web application used to manage student registrations and fee collection. A SQL injection vulnerability in the /bilal/save_class.php file allows unauthenticated attackers to manipulate the 'category' parameter and execute arbitrary SQL queries, potentially leading to unauthorized database access, data theft, data tampering, and complete system compromise.
Technical details
This is a SQL injection vulnerability (CWE-89) in the /bilal/save_class.php file of School Registration and Fee System version 1.0. The vulnerability exists because the 'category' POST parameter is inserted directly into SQL queries without proper sanitization or parameterized query preparation. The attack vector is network-based and requires no authentication. Attackers can exploit this via boolean-based blind and time-based blind SQL injection techniques to read, modify, or delete database records. The vulnerability is publicly disclosed with proof-of-concept payloads demonstrating RLIKE-based and SLEEP-based exploitation methods available in the wild.
Affected products
- SourceCodester School Registration and Fee System 1.0
Timeline
- 2026-08-01: disclosed: Vulnerability disclosed publicly on GitHub
- 2026-09-13: advisory: CVE-2026-90526 published on 2026-09-13