Description

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete_requirement.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-15T04:18:20.230Z",
  "pubdate": "2026-09-15T04:18:20.230Z",
  "executiveSummary": "The Online Faculty Clearance System 1.0 is affected by an SQL injection vulnerability located within the /delete_requirement.php file.\nThe vulnerability arises from improper neutralization of user-supplied data within the 'ID' parameter, allowing an attacker to inject arbitrary SQL commands into the backend database query.\nSuccessful exploitation permits remote attackers to manipulate, exfiltrate, or delete sensitive data from the database, posing a critical risk to data confidentiality, integrity, and availability.\nThis vulnerability is classified as an SQL injection flaw, and because the exploit code has been publicly disclosed, the system is exposed to immediate, unauthorized exploitation attempts from remote actors without requiring prior authentication or elevated privileges.",
  "technicalDetails": "The vulnerability resides in the /delete_requirement.php file of the Online Faculty Clearance System 1.0, specifically within the handling of the 'ID' argument. The application fails to implement robust input validation or parameterized queries when processing this identifier for database deletion operations.\nThe root cause is the inclusion of unsanitized input directly into an SQL statement executed by the database management system. When a request is sent to /delete_requirement.php, the 'ID' parameter is passed to the backend without proper sanitization, enabling the concatenation of malicious SQL syntax into the application's query logic.\nThe exploitation flow begins when an attacker sends a crafted HTTP request to the vulnerable endpoint, supplying a malicious payload within the 'ID' field. For example, by providing input containing SQL delimiters such as a single quote ('), the attacker can escape the intended string context and append arbitrary SQL commands, such as UNION-based queries or stacked queries (if supported by the database configuration).\nBecause the application does not utilize prepared statements or bind variables, the database engine interprets the injected malicious SQL instructions as part of the primary command. This allows the attacker to circumvent access controls and execute database-level operations.\nThe impact of this vulnerability is significant, as it grants the attacker unauthorized control over the database layer. An adversary could perform various actions, including, but not limited to, unauthorized extraction of administrative credentials, modification of faculty records, deletion of critical system data, or gaining further persistence within the server environment. This vulnerability is remotely exploitable, requiring no specific network position, and presents a severe threat due to the accessibility of the exploit vectors in the public domain."
}