Description

A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/pay_report.php. Performing a manipulation of the argument period results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T12:17:15.893Z",
  "pubdate": "2026-09-13T12:17:15.893Z",
  "executiveSummary": "A critical SQL injection (SQLi) vulnerability has been identified in the SourceCodester School Registration and Fee System version 1.0.\nThe vulnerability exists within the /bilal/normal/pay_report.php script due to improper sanitization of the 'period' input parameter.\nThis flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the underlying database, potentially leading to unauthorized data exposure, modification, or complete system compromise.\nThe risk is exacerbated by the public availability of exploit code, increasing the likelihood of successful exploitation by threat actors.\nOrganizations deploying this software are exposed to significant integrity and confidentiality risks, as the application fails to adequately isolate user-supplied input from database query execution logic.",
  "technicalDetails": "The vulnerability is categorized as a classic SQL injection flaw stemming from the insecure handling of user-supplied data within the /bilal/normal/pay_report.php component.\nSpecifically, the 'period' argument is passed directly into a database query without appropriate parameterization, escaping, or validation. This allows an attacker to inject malicious SQL syntax into the application's query structure, effectively altering the intended logic of the database interaction.\nThe attack flow initiates when a remote actor sends a crafted HTTP request (typically a GET or POST request) to the vulnerable endpoint /bilal/normal/pay_report.php, wherein the 'period' parameter is manipulated to contain SQL control characters or keywords. For example, by terminating the original query string and appending a UNION-based or error-based payload, an attacker can bypass authorization mechanisms or exfiltrate sensitive data from the database schema.\nBecause the input is processed server-side without an abstraction layer (such as Prepared Statements or PDO) to enforce query parameter separation, the database engine treats the injected SQL fragments as executable code. This can lead to the unauthorized retrieval of administrative credentials, student records, or financial data associated with the School Registration and Fee System.\nThe vulnerability is exploitable remotely over the network, and because the proof-of-concept exploit is publicly documented, it requires minimal technical sophistication to weaponize. Post-exploitation, an attacker could potentially gain full control over the database, allowing for persistent backdoor insertion, data deletion, or administrative account takeover, depending on the privileges of the database service user account utilized by the web application."
}