Description
A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the file commonController.php of the component checkEmail Endpoint. This manipulation causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Published: 2026-05-01
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a classic SQL injection flaw located in an unknown function of the commonController.php file within the checkEmail endpoint of SourceCodester Advanced School Management System 1.0. Attackers can craft input that bypasses intended validation, allowing them to inject arbitrary SQL statements. Successful exploitation could lead to reading sensitive data, modifying database records, or escalating privileges, depending on the database user’s permissions. The issue is classified under CWE-74 and CWE-89, indicating improper handling of untrusted input that results in structural and programmatic manipulation of SQL queries.

Affected Systems

The affected product is SourceCodester Advanced School Management System, version 1.0, distributed by SourceCodester. No additional versions or build identifiers were provided in the CVE entry.

Risk and Exploitability

The CVSS base score is 6.9, reflecting moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog. Remote exploitation is possible, and public exploit code has already been released on repositories, indicating that attackers could readily target any unpatched installation. Organizers should consider the risk of data exposure and potential disruption when evaluating this flaw. Awaiting vendor remediation, the system remains vulnerable to exploitation.

Generated by OpenCVE AI on May 1, 2026 at 23:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest security release for SourceCodester Advanced School Management System 1.0 from the vendor.
  • If no update is available, disable or restrict access to the checkEmail endpoint and implement input validation or prepared statements in the codebase.
  • Deploy a Web Application Firewall to detect and block SQL injection attempts.
  • Ensure the database account used by the application has the least privileges necessary.

Generated by OpenCVE AI on May 1, 2026 at 23:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 04 May 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 01 May 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester advanced School Management System
Vendors & Products Sourcecodester
Sourcecodester advanced School Management System

Fri, 01 May 2026 02:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the file commonController.php of the component checkEmail Endpoint. This manipulation causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Title SourceCodester Advanced School Management System checkEmail Endpoint commonController.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Sourcecodester Advanced School Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-04T16:53:21.926Z

Reserved: 2026-04-30T18:53:43.878Z

Link: CVE-2026-7545

cve-icon Vulnrichment

Updated: 2026-05-04T16:53:05.820Z

cve-icon NVD

Status : Deferred

Published: 2026-05-01T02:16:04.723

Modified: 2026-05-01T15:26:24.553

Link: CVE-2026-7545

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T00:00:14Z

Weaknesses