Executive brief
The SourceCodester CET Automated Grading System, a web application for managing academic grades, contains a vulnerability that reveals sensitive technical information. By sending specifically crafted requests, an attacker can force the system to display detailed database error messages. This information could be used by a malicious actor to understand the internal structure of the database, potentially facilitating more advanced attacks against the organization's data.
Technical details
An information disclosure vulnerability exists in the SQL Handler component of SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The vulnerability is located in /index.php and can be triggered via the 'manage_subjects' action. By submitting oversized POST parameters (e.g., the 'program' field), a remote authenticated attacker can trigger database exceptions. The application fails to suppress these exceptions, returning verbose error messages that include SQLSTATE responses, PDO exceptions, and MariaDB/MySQL engine details. This exposure of backend architecture details assists in further reconnaissance and exploit development. A public exploit script is available.
Affected products
- SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0
Timeline
- 2026-05-26: disclosed: Initial disclosure and publication of PoC on GitHub
- 2026-05-26: advisory: CVE-2026-9583 published in NVD dataset
References
- https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-9583-Information-Disclosure/Advisory.md
- https://github.com/NARKHEDE-VAIBHAV/poc/blob/main/CVE-2026-9583-Information-Disclosure/poc.sh
- https://vuldb.com/submit/817932
- https://vuldb.com/vuln/365639
- https://vuldb.com/vuln/365639/cti
- https://www.sourcecodester.com/