Description

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requirement_status.php. The manipulation of the argument haydi results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-15T04:18:20.450Z",
  "pubdate": "2026-09-15T04:18:20.450Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in SourceCodester Online Faculty Clearance System 1.0. The vulnerability resides within the /update_requirement_status.php script, specifically via improper neutralization of user-supplied input in the 'haydi' parameter.\nThis flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the underlying database. The vulnerability poses a severe risk to the confidentiality, integrity, and availability of the system. Successful exploitation could lead to unauthorized data exfiltration, modification of clearance records, or complete compromise of the database management system.\nGiven that exploit code is publicly available, the system faces an elevated risk of automated or targeted exploitation attempts. The vulnerability is exploitable remotely, requiring no specific privileges or specialized access beyond network connectivity to the targeted web application. Immediate remediation is necessary to prevent potential security breaches.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw stemming from the failure of the application to properly sanitize or parameterize user-supplied input before incorporating it into a database query. In the /update_requirement_status.php script, the 'haydi' argument is directly concatenated into a SQL statement, allowing an attacker to manipulate the query structure.\nThe attack flow begins when an attacker sends a crafted HTTP request to /update_requirement_status.php, injecting malicious SQL syntax through the 'haydi' parameter. Because the application logic fails to use prepared statements or robust input validation, the database interpreter treats the injected payload as part of the intended SQL command.\nBy manipulating the 'haydi' parameter, an attacker can bypass intended query logic, execute union-based attacks to extract data from other tables, or perform blind SQL injection to infer database contents bit-by-bit. If the database user configuration follows poor security practices, such as running with excessive administrative privileges, an attacker might escalate the impact to include data deletion or arbitrary file operations.\nThe vulnerability is fully accessible over the network, making it a high-priority target. Since the flaw exists in an /update_requirement_status.php file, it suggests that the backend processes sensitive clearance requirements, which could be altered to bypass faculty clearance protocols, essentially subverting the functional purpose of the system.\nStep-by-step exploitation: 1) The attacker identifies the target endpoint /update_requirement_status.php. 2) The attacker tests for SQL injection by injecting characters like single quotes (') or specific SQL functions into the 'haydi' parameter. 3) The application returns a database error or behaves differently, confirming the vulnerability. 4) The attacker constructs a payload to exfiltrate database metadata, credentials, or sensitive faculty data. 5) The server processes the malicious input, executing the payload and returning the requested data to the attacker."
}