CVE-2026-7545

SourceCodester Advanced School Management System checkEmail Endpoint commonController.php sql injection

View on CVE.org
Published May 1, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the file commonController.php of the component checkEmail Endpoint. This manipulation causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Analysis

AI-generated

Technical impact

The vulnerability is a classic SQL injection flaw located in an unknown function of the commonController.php file within the checkEmail endpoint of SourceCodester Advanced School Management System 1.0. Attackers can craft input that bypasses intended validation, allowing them to inject arbitrary SQL statements. Successful exploitation could lead to reading sensitive data, modifying database records, or escalating privileges, depending on the database user’s permissions. The issue is classified under CWE-74 and CWE-89, indicating improper handling of untrusted input that results in structural and programmatic manipulation of SQL queries.

Affected Systems

The affected product is SourceCodester Advanced School Management System, version 1.0, distributed by SourceCodester. No additional versions or build identifiers were provided in the CVE entry.

Risk and Exploitability

The CVSS base score is 6.9, reflecting moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog. Remote exploitation is possible, and public exploit code has already been released on repositories, indicating that attackers could readily target any unpatched installation. Organizers should consider the risk of data exposure and potential disruption when evaluating this flaw. Awaiting vendor remediation, the system remains vulnerable to exploitation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security release for SourceCodester Advanced School Management System 1.0 from the vendor.
  • If no update is available, disable or restrict access to the checkEmail endpoint and implement input validation or prepared statements in the codebase.
  • Deploy a Web Application Firewall to detect and block SQL injection attempts.
  • Ensure the database account used by the application has the least privileges necessary.

Generated by OpenCVE AI on May 1, 2026 at 23:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Sourcecodester
Sourcecodester advanced School Management System
Vendors & Products Sourcecodester
Sourcecodester advanced School Management System
Type Values Removed Values Added
Description A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the file commonController.php of the component checkEmail Endpoint. This manipulation causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Title SourceCodester Advanced School Management System checkEmail Endpoint commonController.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 4, 2026, 4:53 PM
Reserved
Apr 30, 2026, 6:53 PM

View source JSON

Updated
May 4, 2026, 4:53 PM

JSON

Status
Deferred
Published
May 1, 2026, 2:16 AM
Modified
Oct 26, 2026, 10:10 PM

View source JSON

No data.

Updated
May 2, 2026, 12:00 AM

JSON