Description
A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /admin/message/search.php. Executing a manipulation of the argument term can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Published: 2026-02-07
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Patch Immediately
AI Analysis

Impact

A vulnerability was discovered in SourceCodester Online Class Record System 1.0 affecting the admin/message/search.php script. Manipulating the 'term' argument results in a SQL injection. This flaw allows an attacker to execute arbitrary SQL statements against the backend database, potentially exposing sensitive data, corrupting or deleting data, and compromising system availability. The weakness is a classic SQL injection (CWE‑89) and also involves improper command construction (CWE‑74).

Affected Systems

The affected product is SourceCodester Online Class Record System version 1.0. No other vendors or product versions were mentioned. The vulnerability is tied to the /admin/message/search.php endpoint of that system.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium severity, and the EPSS score of <1% suggests a low likelihood of exploitation at present. The vulnerability is publicly disclosed and can be triggered remotely by sending a crafted 'term' request to the admin area. Based on the description, it is inferred that the attack may require administrative authentication or network access to the system, though the description does not specify authentication requirements. The vulnerability is not yet listed in the CISA KEV catalog.

Generated by OpenCVE AI on April 18, 2026 at 13:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Online Class Record System to the latest version once the vendor releases a patch.
  • Modify the search.php handler to sanitize the 'term' input or use prepared statements to prevent SQL concatenation.
  • Restrict access to the /admin/message/search.php endpoint by enforcing authentication and applying firewall or web‑server access controls.

Generated by OpenCVE AI on April 18, 2026 at 13:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Janobe
Janobe online Class Record System
CPEs cpe:2.3:a:janobe:online_class_record_system:1.0:*:*:*:*:*:*:*
Vendors & Products Janobe
Janobe online Class Record System

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester online Class Record System
Vendors & Products Sourcecodester
Sourcecodester online Class Record System

Sat, 07 Feb 2026 15:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /admin/message/search.php. Executing a manipulation of the argument term can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Title SourceCodester Online Class Record System search.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Janobe Online Class Record System
Sourcecodester Online Class Record System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:33:04.785Z

Reserved: 2026-02-06T08:25:40.592Z

Link: CVE-2026-2090

cve-icon Vulnrichment

Updated: 2026-02-10T15:55:23.427Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-07T16:15:47.727

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-2090

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T13:30:45Z

Weaknesses