Description

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view_department.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-13T16:17:59.560Z",
  "pubdate": "2026-08-13T16:17:59.560Z",
  "executiveSummary": "A critical security vulnerability has been identified within the SourceCodester Simple Student Information System, specifically residing in the file app/admin/departments/view_department.php. This vulnerability manifests as an SQL Injection (SQLi) flaw, allowing remote malicious actors to manipulate the application's database queries by tampering with the id parameter. The presence of this vulnerability introduces significant risk to the confidentiality, integrity, and availability of the underlying database management system. Successful exploitation of this flaw can lead to unauthorized data access, modification, or deletion, and potentially complete compromise of the affected web application server depending on database privileges. The attack vector is completely remote, requiring network connectivity to the target system without necessitating prior authentication or specialized privileges, assuming public exploit availability. Organizations utilizing this software face severe exposure to data exfiltration and administrative bypass scenarios, making immediate remediation essential to secure the affected environment against active exploitation.",
  "technicalDetails": "The vulnerability is rooted in the improper neutralization of special elements used in an SQL command within the source code of app/admin/departments/view_department.php. Specifically, user-supplied input passed via the id parameter is directly concatenated or insufficiently sanitized before being incorporated into a database query. This architectural flaw allows an attacker to inject arbitrary SQL fragments, altering the intended logic of the database query executed by the backend database management system.\nThe exploitation mechanism relies on submitting crafted HTTP requests containing malicious SQL payloads targeted at the vulnerable id parameter within the context of the view_department.php endpoint. Because the application fails to utilize parameterized queries or prepared statements, the database engine interprets the injected strings as executable SQL commands rather than inert data parameters.\nThe step-by-step attack flow begins with the attacker identifying the target URL corresponding to app/admin/departments/view_department.php and isolating the id parameter used to fetch department records. The attacker then crafts an input string incorporating SQL syntax, such as UNION-based operators, boolean-based conditions, or stacked queries. Upon transmitting this payload via HTTP GET or POST methods, the server processes the request and hands the tainted query to the database. The database executes the modified query, returning unintended dataset results, error messages revealing database schema details, or executing administrative commands depending on the nature of the payload and the database user privileges.\nThe vulnerable component is the server-side script located at app/admin/departments/view_department.php within SourceCodester Simple Student Information System across unspecified versions. The attack surface is exposed remotely over the network, requiring HTTP/HTTPS access to the web application. Exploitation requires no prior authentication or privileged access, lowering the barrier to entry for potential attackers. Post-exploitation impact includes the potential extraction of sensitive database records, bypassing authentication controls, reading system files accessible via the database, or modifying application data."
}