CVE-2026-90526

SourceCodester School Registration and Fee System save_class.php sql injection

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_class.php. The manipulation of the argument Category leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Analysis

AI-generated

Technical impact

The SourceCodester School Registration and Fee System 1.0 contains a vulnerability in the /bilal/save_class.php script. A malicious user can send a crafted Category parameter that is incorporated directly into an SQL statement, allowing injection of arbitrary SQL code. The flaw permits remote attackers to read sensitive database data or modify records, and it can be triggered without authentication if the endpoint is publicly reachable.

Affected Systems

The affected product is SourceCodester School Registration and Fee System version 1.0. No other vendors or versions are currently documented as impacted.

Risk and Exploitability

The CVSS base score of 6.9 indicates moderate severity. The EPSS score is less than 1%, suggesting a very low likelihood of exploitation at this time, yet the vulnerability is publicly disclosed and example exploits are available. Attackers could remotely send a crafted HTTP request to /bilal/save_class.php from any networked machine, potentially bypassing authentication if the application is exposed to the internet. The risk is realistic for publicly accessible installations.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update SourceCodester School Registration and Fee System to a patched version that eliminates the injection point or apply the vendor patch.
  • Modify the code to sanitize the Category input and use prepared statements or parameterized queries to prevent injection.
  • Configure the database user used by the application to have only the minimum permissions required, reducing the potential impact of an injection.

Generated by OpenCVE AI on September 15, 2026 at 16:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_class.php. The manipulation of the argument Category leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Title SourceCodester School Registration and Fee System save_class.php sql injection
First Time appeared Sourcecodester
Sourcecodester school Registration And Fee System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:sourcecodester:school_registration_and_fee_system:*:*:*:*:*:*:*:*
Vendors & Products Sourcecodester
Sourcecodester school Registration And Fee System
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 14, 2026, 5:23 PM
Reserved
Sep 12, 2026, 10:58 AM

View source JSON

Updated
Sep 14, 2026, 5:23 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 2:16 PM
Modified
Sep 14, 2026, 8:56 PM

View source JSON

No data.

Updated
Sep 15, 2026, 4:45 PM

JSON