Description

A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_class.php. The manipulation of the argument Category leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T14:16:50.660Z",
  "pubdate": "2026-09-13T14:16:50.660Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the SourceCodester School Registration and Fee System 1.0, specifically residing within the /bilal/save_class.php file.\nThe vulnerability arises due to improper neutralization of user-supplied data within the 'Category' argument before being processed in a database query.\nSuccessful exploitation allows a remote, unauthenticated attacker to manipulate back-end database queries, potentially leading to unauthorized data disclosure, modification, or total compromise of the database integrity.\nGiven that the exploit code has been disclosed publicly, the risk to organizations deploying this software is severe, as it facilitates trivial exploitation by malicious actors.\nThe vulnerability represents a significant security flaw that undermines the confidentiality, integrity, and availability of the application data.",
  "technicalDetails": "The vulnerability is a classic SQL injection (SQLi) flaw localized to the /bilal/save_class.php script. The root cause is the failure of the application to properly sanitize or parameterize the 'Category' HTTP POST/GET parameter before including it in a SQL statement executed against the database management system.\nThe attack flow begins when an attacker crafts a malicious request targeting the /bilal/save_class.php endpoint. By injecting SQL syntax meta-characters (such as single quotes, semicolons, or comment indicators) into the 'Category' input field, the attacker can alter the structure of the underlying database query.\nBecause the application does not utilize prepared statements or parameterized queries, the database engine interprets the attacker-supplied malicious strings as executable SQL commands. This allows the attacker to bypass intended application logic.\nFrom an exploitation perspective, an attacker can manipulate the query to perform various operations, including but not limited to: extracting sensitive information from other tables within the database (e.g., administrator credentials, user records, or financial data), modifying existing data, or, depending on the database configuration and permissions, potentially executing administrative functions.\nThe vulnerability is remotely exploitable without requiring authentication, meaning any network-adjacent or internet-facing instance of the School Registration and Fee System 1.0 is susceptible. The absence of input validation and the lack of an abstraction layer between user input and the database interface make this a high-impact vulnerability.\nPost-exploitation impact includes the full compromise of the application's data. If the database user utilized by the application has excessive privileges (such as FILE permissions or the ability to execute system-level commands), the attacker might escalate the attack to gain further unauthorized access to the underlying server environment."
}