Executive brief
SourceCodester Online Faculty Clearance System is a web application used to manage faculty clearance workflows. The system contains a SQL injection vulnerability in the requirement deletion feature that allows unauthenticated attackers to execute arbitrary database commands, potentially leading to unauthorized access, data theft, data modification, and service disruption. No authentication or special permissions are required to exploit this flaw.
Technical details
The vulnerability is a SQL injection flaw in the /delete_requirement.php file where the 'id' parameter is concatenated directly into SQL queries without proper input validation or parameterized query preparation. An attacker can send a crafted GET request with malicious SQL code in the 'id' parameter to exploit error-based, time-based blind, or stacked query injection techniques. The attack is network-accessible and requires no authentication. Successful exploitation allows complete database compromise, including data exfiltration, modification, and deletion. The fix requires implementing prepared statements with parameter binding and strict input validation on all user-supplied data.
Affected products
- SourceCodester Online Faculty Clearance System 1.0
Timeline
- 2026-08-13: disclosed: Vulnerability disclosed on GitHub
- 2026-09-15: advisory: CVE-2026-90876 published