SQL Injection in SourceCodester School Registration and Fee System

A remote SQL injection vulnerability, tracked as CVE-2026-90514, has been identified in SourceCodester School Registration and Fee System version 1.0. The flaw resides in the /bilal/normal/save_stud.php script, where the 'Status' argument is improperly sanitized before being processed by the application's database backend.

This vulnerability allows a remote, unauthenticated attacker to manipulate SQL queries, which can lead to unauthorized data exfiltration, modification, or complete database compromise. Because this application is commonly deployed in school environments for managing student registration and fee collection, the potential impact includes the theft of sensitive personal identifiable information (PII) of students and faculty. Exploitation details have been disclosed publicly, increasing the likelihood of opportunistic attacks targeting exposed instances of this software. Defenders should prioritize patching or restricting access to the affected web application.

Impact

The vulnerability poses a high risk to educational institutions utilizing the School Registration and Fee System 1.0. Successful exploitation allows for full unauthorized access to the underlying database, potentially resulting in the compromise of student financial records, personal identification, and administrative data. If exploited, attackers can exfiltrate sensitive records or delete database contents to disrupt system operations.

Recommendation

• Perform a search for internet-facing instances of SourceCodester School Registration and Fee System and implement WAF rules to block requests containing SQL syntax in the Status parameter of /bilal/normal/save_stud.php.
• Review web server access logs for anomalous POST or GET requests to /bilal/normal/save_stud.php containing SQL keywords like UNION, SELECT, or SLEEP.
• If the application is not business-critical or can be replaced, decommission the instance until a vendor-provided security patch is applied.