Description

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-15T06:17:01.910Z",
  "pubdate": "2026-09-15T06:17:01.910Z",
  "executiveSummary": "The SourceCodester Online Faculty Clearance System 1.0 contains a critical SQL injection vulnerability located within the /delete_faculty1.php file. This vulnerability arises from improper neutralization of user-supplied data passed through the ID parameter, allowing unauthorized parties to manipulate backend database queries remotely. By injecting malicious SQL commands, an attacker can bypass authentication mechanisms, access sensitive faculty information, modify existing database records, or potentially execute administrative operations. The vulnerability poses a significant risk to the integrity and confidentiality of the system's data. Exploitation is possible remotely, requiring no specialized access beyond network connectivity to the target application. Given that the exploit code has been publicly disclosed, the system is at an immediate risk of compromise by malicious actors seeking to leverage this flaw to gain unauthorized database access.",
  "technicalDetails": "The Online Faculty Clearance System 1.0 is susceptible to a classic SQL injection vulnerability due to the insecure handling of the ID argument within the /delete_faculty1.php script. The vulnerability exists because the application directly incorporates user-supplied input from the ID parameter into a SQL query string without adequate sanitization, validation, or the use of parameterized statements (prepared statements).\nIn a typical attack scenario, the /delete_faculty1.php file receives an ID parameter intended to identify a specific faculty record for deletion. An attacker can intercept or craft a request where the ID parameter is modified to include SQL syntax—such as union-based or boolean-based payloads—rather than a simple integer identifier. Because the backend database engine processes the concatenated string as an executable command, the attacker can break out of the intended query context.\nFor instance, an attacker could supply a payload such as '1 OR 1=1' to manipulate the query logic, causing the application to return all records or execute unintended database actions. Because the input is not parameterized, the application fails to distinguish between legitimate data and executable control commands. The vulnerability allows for remote execution of arbitrary SQL commands against the underlying database management system (DBMS).\nThe attack flow follows a straightforward process: first, the attacker identifies the /delete_faculty1.php file as the target entry point. Second, the attacker probes the ID parameter to confirm the vulnerability by injecting SQL control characters (e.g., single quotes). Third, upon confirming the injection, the attacker injects malicious payloads to dump database contents, modify records, or extract system-level information. The impact is severe, as successful exploitation facilitates unauthorized access to the application's entire dataset, potentially leading to a complete compromise of the faculty clearance information. As this is a server-side flaw, no client-side interaction is required to achieve successful exploitation, and the threat can be initiated from any external network source capable of reaching the web application."
}