Description

A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/delete_stud.php. Executing a manipulation of the argument selector[] can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T12:17:15.147Z",
  "pubdate": "2026-09-13T12:17:15.147Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the SourceCodester School Registration and Fee System 1.0. The vulnerability resides within the /bilal/normal/delete_stud.php file, specifically affecting the 'selector[]' argument.\nThis flaw allows a remote, unauthenticated attacker to inject malicious SQL commands into the backend database. By manipulating the input parameter, an adversary can bypass security controls to read, modify, or delete sensitive data stored within the registration and fee system database.\nThe vulnerability represents a significant risk to data integrity, confidentiality, and availability. Since the exploit code is publicly disclosed, the risk of exploitation by malicious actors is high. Attackers do not necessarily require specialized access to the application to trigger the vulnerability, as it can be initiated remotely via standard HTTP requests.\nSuccessful exploitation could lead to unauthorized administrative control over the database, potential exposure of student and financial records, and total compromise of the application's data layer.",
  "technicalDetails": "The vulnerability is categorized as a classic SQL injection, occurring because the application fails to adequately sanitize or parameterize user-supplied input before incorporating it into database queries. In the School Registration and Fee System 1.0, the script located at /bilal/normal/delete_stud.php processes the 'selector[]' array parameter.\nThe root cause of this vulnerability is the insecure construction of SQL statements. It is highly probable that the application utilizes the content of the 'selector[]' parameter directly in a database query, likely within a 'WHERE' clause during the deletion process. Because the input is not treated as data, but rather as executable command code, a specially crafted string can alter the logic of the intended SQL operation.\nThe attack flow proceeds as follows: An attacker sends a malicious HTTP request (typically via POST) to the vulnerable endpoint /bilal/normal/delete_stud.php. The attacker embeds a crafted SQL payload within the 'selector[]' array index. For instance, inputting '1 OR 1=1' instead of a standard identifier can manipulate the query condition to target records beyond the scope intended by the developer. By chaining these inputs, an attacker can perform union-based attacks to extract arbitrary data from the database schema.\nGiven that this is a remote exploitation vector, the attacker does not need local system access or pre-existing credentials, depending on the implementation of the surrounding environment. The vulnerability effectively allows the injection of arbitrary SQL commands into the backend database engine. Post-exploitation impact is severe, as the attacker can perform unauthorized CRUD (Create, Read, Update, Delete) operations, potentially leading to a full database dump, the modification of fee records, or the deletion of student information, resulting in permanent data loss and system-wide corruption of the registration records."
}