Executive brief
SourceCodester's Online Faculty Clearance System is a web-based tool used by educational institutions to manage faculty clearance processes. A SQL injection flaw in the update_requirement_status.php file allows unauthenticated attackers to inject malicious database commands through an unsanitized parameter, potentially exposing or corrupting sensitive personnel records, modifying system data, or gaining unauthorized access to the entire database.
Technical details
A SQL injection vulnerability exists in the 'haydi' parameter of the OnlineClearance/update_requirement_status.php file due to insufficient input validation and lack of prepared statements. The vulnerable parameter is processed directly into SQL queries without sanitization, allowing attackers to inject multiple SQL injection vectors including boolean-based blind, error-based, stacked queries, and time-based blind techniques. No authentication is required to exploit this vulnerability; an attacker can send a crafted HTTP POST request with malicious SQL payloads to achieve unauthorized database access, data exfiltration, modification, or deletion. Patch status is unknown; the advisory recommends implementing prepared statements with parameter binding, input validation, and restricting database user permissions.
Affected products
- SourceCodester Online Faculty Clearance System 1.0
Timeline
- 2026-08-13: disclosed
- 2026-09-15: advisory