Sourcecodester - CraftedSignal Threat Feed

CVE-2026-14732: SQL Injection in SourceCodester Class and Exam Timetabling System

hello@craftedsignal.io — Sun, 05 Jul 2026 09:18:49 +0000

A critical SQL injection vulnerability (CVE-2026-14732) has been publicly disclosed in SourceCodester Class and Exam Timetabling System version 1.0. This flaw, residing in the /edit_exam.php file, allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database by manipulating the ID argument. The vulnerability was published to NVD on July 5, 2026, with a CVSS v3.1 base score of 7.3 (High). The public disclosure of exploit details means that this vulnerability can be actively leveraged by malicious actors. Organizations using this system are at immediate risk of data compromise, unauthorized access, and potential remote code execution, making prompt remediation crucial for protecting sensitive information and maintaining system integrity. This affects any instance exposed to the internet.

Attack Chain

Attacker identifies an internet-facing instance of SourceCodester Class and Exam Timetabling System 1.0.
Attacker crafts a specially formed HTTP GET or POST request targeting the /edit_exam.php endpoint.
The request includes a malicious SQL payload within the ID argument (e.g., id=1%27+UNION+SELECT+null,user(),null--).
The vulnerable application processes this request without properly sanitizing the ID input, causing the web server to execute the attacker's embedded SQL query against its backend database.
The database responds to the malicious query, potentially revealing sensitive data such as user credentials, database schema, or other confidential information.
The web server includes the results of the SQL query within the HTTP response, allowing the attacker to exfiltrate the compromised data.

Impact

Successful exploitation of CVE-2026-14732 can lead to severe consequences for organizations utilizing SourceCodester Class and Exam Timetabling System 1.0. Attackers can exfiltrate sensitive student and faculty data, manipulate existing records, or gain administrative access to the application. This could result in privacy breaches, academic fraud, disruption of critical scheduling operations, and reputational damage. The public availability of exploit details increases the likelihood of widespread targeting and automated attacks against vulnerable systems, posing a significant risk to affected educational institutions or internal training departments.

Recommendation

Patch CVE-2026-14732 on all affected SourceCodester Class and Exam Timetabling System 1.0 instances immediately.
Deploy the provided Sigma rule to your SIEM to detect exploitation attempts targeting /edit_exam.php.
Review web server access logs for SourceCodester Class and Exam Timetabling System 1.0 for requests to /edit_exam.php containing suspicious ID parameters indicative of SQL injection.

CVE-2026-14719: SourceCodester Onlne Examination & Learning Management System Privilege Escalation

hello@craftedsignal.io — Sun, 05 Jul 2026 08:20:00 +0000

A significant vulnerability, tracked as CVE-2026-14719, has been discovered in SourceCodester Onlne Examination & Learning Management System version 1.0. This flaw affects the Registration Endpoint, specifically within the register.php file, where it exhibits improper privilege management. Attackers can exploit this by manipulating the role argument during user registration. This remote vulnerability can lead to privilege escalation, allowing an unauthenticated attacker to gain elevated access within the system, potentially compromising sensitive educational data or administrative functions. The severity of this issue is heightened by the fact that a public exploit has been published and is readily available for use, making it an immediate threat to organizations utilizing this system. Defenders should prioritize patching and monitoring for exploitation attempts.

Attack Chain

Reconnaissance: An attacker identifies a publicly accessible instance of SourceCodester Onlne Examination & Learning Management System 1.0.
Vulnerability Identification: The attacker confirms the application version and identifies the vulnerable register.php endpoint.
Crafted Request: The attacker crafts an HTTP POST request to /register.php that includes a manipulated role argument within the registration data.
Exploitation: The crafted request is sent to the vulnerable endpoint, attempting to assign an elevated role (e.g., 'admin', 'instructor') to a newly created user account.
Privilege Assignment: Due to improper privilege management inherent in CVE-2026-14719, the system processes the request and creates the new user with the attacker-specified elevated role.
Unauthorized Access: The attacker logs into the system using the credentials of the newly created account, now possessing administrative or other highly privileged access.
Impact: The attacker gains full control over system functionalities, potentially accessing sensitive student records, modifying examination content, or disrupting learning operations.

Impact

The exploitation of CVE-2026-14719 can lead to severe consequences. Attackers can achieve unauthorized privilege escalation, granting them full administrative control over the SourceCodester Onlne Examination & Learning Management System. This can result in data breaches involving sensitive student or faculty information, unauthorized modification of grades or course materials, system downtime, and reputational damage for educational institutions. The public availability of an exploit significantly increases the likelihood of widespread attacks, putting all unpatched instances at immediate risk of compromise. The CVSS 3.1 Base Score of 7.3 (High) underscores the critical nature of this vulnerability.

Recommendation

Patch CVE-2026-14719: Immediately apply any available patches or vendor-provided mitigations for SourceCodester Onlne Examination & Learning Management System 1.0 to address CVE-2026-14719.
Implement WAF Rules: Deploy a Web Application Firewall (WAF) to block HTTP POST requests to /register.php that contain suspicious role parameter manipulations, as indicated in the Sigma rule.
Monitor Web Logs: Enable and review web server logs for /register.php access patterns, specifically looking for HTTP POST requests with a role argument, as described in the provided Sigma rule.
Audit New User Registrations: Regularly audit new user registrations for the SourceCodester Onlne Examination & Learning Management System, paying close attention to any accounts created with elevated or unusual privilege levels.

CVE-2026-14713 — SQL Injection in SourceCodester Pizzafy E-Commerce System

hello@craftedsignal.io — Sun, 05 Jul 2026 06:26:12 +0000

A significant security flaw, tracked as CVE-2026-14713, has been identified in the SourceCodester Pizzafy E-Commerce System 1.0. This vulnerability manifests as a remote SQL injection within the /admin/ajax.php file, specifically when handling the ID argument in the action=confirm_order context. Threat actors can exploit this by crafting malicious HTTP requests that embed SQL queries into the ID parameter. The flaw allows for unauthenticated remote exploitation, meaning attackers can leverage it without prior access to the system. The existence of a public exploit for this vulnerability elevates the immediate risk, making it critical for organizations using this software to patch or implement protective measures swiftly to prevent potential data breaches, unauthorized data manipulation, or system compromise.

Attack Chain

Attacker identifies a publicly accessible instance of SourceCodester Pizzafy E-Commerce System 1.0.
Attacker crafts a specially designed HTTP GET request targeting the /admin/ajax.php endpoint.
The request includes the action=confirm_order parameter and a malicious SQL payload embedded within the ID argument (e.g., ID=1 UNION SELECT @@version, user(), database()).
The vulnerable application processes this request, failing to properly sanitize the ID parameter, and executes the attacker-supplied SQL query against its backend database.
The database management system (DBMS) processes the injected query and returns the results within the legitimate HTTP response from the web server.
Attacker parses the web server's response to extract sensitive information, such as database schema, user credentials, system configuration, or other confidential data.
The attacker continues to refine payloads to further exfiltrate, modify, or potentially corrupt data within the database, ultimately achieving data compromise.

Impact

Successful exploitation of CVE-2026-14713 can lead to severe consequences for organizations utilizing SourceCodester Pizzafy E-Commerce System 1.0. As a remote SQL injection vulnerability, attackers can gain unauthorized access to the underlying database. This typically results in full data compromise, including exfiltration of sensitive customer data (names, addresses, payment information), administrative credentials, and other proprietary business data. Attackers could also tamper with order details, pricing, inventory, or user accounts, causing financial losses, reputational damage, and operational disruption. While the source does not specify victim count or targeted sectors, any organization deploying this specific version of the e-commerce system is at high risk.

Recommendation

Immediately patch SourceCodester Pizzafy E-Commerce System 1.0 to a non-vulnerable version if available.
Deploy the Sigma rule "Detects CVE-2026-14713 Exploitation — Pizzafy SQL Injection" to your SIEM/WAF and tune for your environment.
Enable comprehensive web server logging (category webserver) to capture cs-uri-stem, cs-uri-query, and cs-method for detailed forensic analysis.

CVE-2026-14695: SourceCodester Multi-Vendor Online Grocery Management System SQL Injection

hello@craftedsignal.io — Sun, 05 Jul 2026 03:17:53 +0000

A significant vulnerability, identified as CVE-2026-14695, has been discovered in SourceCodester Multi-Vendor Online Grocery Management System version 1.0. This flaw specifically affects the save_client function located within the classes/Users.php file, which is part of the Registration Handler component. Attackers can remotely exploit this weakness by manipulating the 'Name' argument, leading to a classic SQL injection scenario. The presence of a publicly available exploit significantly escalates the risk, making affected systems immediate targets for data compromise or further malicious activity. This vulnerability has a CVSS v3.1 base score of 7.3, categorizing it as high severity due to its network-exploitability and potential for data impact.

Attack Chain

Attacker identifies a target running SourceCodester Multi-Vendor Online Grocery Management System 1.0 through reconnaissance.
Attacker crafts a malicious HTTP POST request, targeting the classes/Users.php file and specifically the save_client function.
The crafted request includes an SQL injection payload embedded within the 'Name' argument, designed to bypass input validation.
Upon receipt, the vulnerable save_client function processes the unsanitized 'Name' argument, directly incorporating the malicious string into a database query.
The malicious SQL query is then executed by the backend database, granting the attacker unauthorized access to, or manipulation of, the database contents.
Attacker proceeds to exfiltrate sensitive data, such as user credentials, customer information, or product details, or alters existing data for fraudulent purposes.

Impact

The successful exploitation of CVE-2026-14695 can lead to severe consequences for organizations utilizing SourceCodester Multi-Vendor Online Grocery Management System 1.0. Attackers can gain unauthorized access to critical backend databases, potentially compromising sensitive customer data including names, addresses, purchase history, and even authentication credentials. This breach can result in significant financial losses, reputational damage, regulatory penalties (e.g., GDPR, CCPA violations), and disruption of business operations. The public availability of an exploit increases the likelihood of widespread targeting.

Recommendation

Patch CVE-2026-14695 immediately: Apply any available patches or vendor-provided updates for SourceCodester Multi-Vendor Online Grocery Management System 1.0 to address the SQL injection vulnerability.
Implement Web Application Firewall (WAF) rules: Configure WAFs to detect and block SQL injection attempts, specifically looking for common SQLi patterns in POST requests targeting classes/Users.php and the 'Name' argument.
Conduct code review and input validation: Perform a thorough security audit of the save_client function in classes/Users.php and all other input handling components to ensure proper sanitization and parameterized queries are used.

CVE-2026-14690: Improper Authorization in SourceCodester Multi-Vendor Online Grocery Management System

hello@craftedsignal.io — Sun, 05 Jul 2026 02:19:33 +0000

A significant security flaw, tracked as CVE-2026-14690, has been identified in SourceCodester Multi-Vendor Online Grocery Management System version 1.0. This vulnerability specifically resides within the save_users function located in the classes/Users.php file. The weakness stems from improper authorization controls, allowing an attacker to bypass security checks and manipulate user accounts. Remote exploitation is possible, meaning attackers do not need prior access to the system or user credentials. A public exploit has been made available, increasing the urgency for immediate remediation. For defenders, this vulnerability represents a critical risk of unauthorized access, privilege escalation, and potential compromise of the online grocery management system, including sensitive customer and transactional data.

Attack Chain

An unauthenticated remote attacker identifies the vulnerable SourceCodester Multi-Vendor Online Grocery Management System 1.0 instance.
The attacker crafts a malicious HTTP POST request targeting the /classes/Users.php endpoint to invoke the save_users function.
Due to the improper authorization flaw, the application fails to adequately verify the attacker's privileges or authentication status for the save_users operation.
The attacker leverages this bypass to create a new administrative user account or modify the roles/privileges of an existing low-privileged user.
With the newly acquired or elevated administrative credentials, the attacker logs into the system.
The attacker gains full administrative control over the Multi-Vendor Online Grocery Management System, potentially leading to data exfiltration, system defacement, or further compromise of the underlying server.

Impact

Successful exploitation of CVE-2026-14690 would grant unauthorized administrative access to the Multi-Vendor Online Grocery Management System. This direct compromise could lead to severe consequences, including the theft of sensitive customer information (e.g., personal data, order history), financial transaction manipulation, alteration of product inventories, or complete disruption of the online grocery platform. While specific victim counts are not available, any organization utilizing this vulnerable software is at risk of significant reputational damage, financial loss, and regulatory penalties due to data breaches and service interruptions.

Recommendation

Immediately apply any available patches or security updates from SourceCodester for the Multi-Vendor Online Grocery Management System 1.0 to address CVE-2026-14690.
Review access logs for /classes/Users.php for any unauthorized or suspicious POST requests that occurred prior to applying the patch for CVE-2026-14690.
Perform an audit of user accounts, especially administrative accounts, for any newly created or modified users since the system's deployment or the disclosure of CVE-2026-14690, investigating any anomalous entries.
Refer to the provided references (https://vuldb.com/cve/CVE-2026-14690, https://github.com/lee945/cve/issues/1) for further details on the vulnerability and potential mitigation strategies.

CVE-2026-14654: Remote SQL Injection in SourceCodester Simple and Nice Shopping Cart Script

hello@craftedsignal.io — Sat, 04 Jul 2026 21:20:52 +0000

A critical SQL injection vulnerability, identified as CVE-2026-14654, has been discovered in version 1.0 of the SourceCodester Simple and Nice Shopping Cart Script. This flaw specifically affects an unknown function within the /admin/girlsproductdeletequery.php file, where improper neutralization of special elements in the user_id argument leads to SQL injection. The vulnerability allows a remote and unauthenticated attacker to inject malicious SQL commands into database queries. The exploit for this vulnerability is publicly available, increasing the likelihood of its use in the wild. This poses a significant risk to organizations utilizing the affected software, enabling potential unauthorized access, data manipulation, or even remote code execution if the underlying database user has elevated privileges. The vulnerability was published on July 4, 2026.

Attack Chain

An attacker identifies an internet-facing instance of SourceCodester Simple and Nice Shopping Cart Script 1.0.
The attacker crafts a malicious HTTP GET or POST request to the /admin/girlsproductdeletequery.php endpoint.
The request includes specially constructed SQL injection payloads within the user_id parameter, such as ' OR 1=1-- or UNION SELECT ....
The vulnerable application processes the user_id argument without adequate sanitization, causing the injected SQL commands to be executed by the backend database.
Successful injection allows the attacker to bypass authentication, query sensitive database information (e.g., user credentials, product details), modify existing data, or delete records.
Depending on the database system and the privileges of the database user account, the attacker may escalate the SQL injection to achieve remote code execution (RCE) on the underlying web server.
If RCE is successful, the attacker can establish persistent access mechanisms, such as deploying web shells or other backdoors.
The final objective often includes data exfiltration, website defacement, or broader compromise of the hosting infrastructure.

Impact

Successful exploitation of CVE-2026-14654 can lead to severe consequences for affected organizations. Attackers can gain unauthorized access to the application's database, allowing for the theft of sensitive customer and product information, modification of order details, or deletion of critical data. While specific victim counts or targeted sectors are not available, any organization using SourceCodester Simple and Nice Shopping Cart Script 1.0 is at risk. The publicly available exploit further exacerbates the threat, making it easier for malicious actors to compromise systems and disrupt business operations.

Recommendation

Immediately patch SourceCodester Simple and Nice Shopping Cart Script 1.0 if an official update is available, or remove the affected component from internet exposure.
Deploy the Sigma rule "Detect CVE-2026-14654 Exploitation - SQL Injection in Shopping Cart Script" to your SIEM for early detection of exploitation attempts.
Monitor web server access logs for requests targeting /admin/girlsproductdeletequery.php that contain unusual or suspicious characters and SQL keywords as described in the detection rule.
Review the references provided, particularly https://github.com/Yuesswor/cve/issues/4 and https://vuldb.com/vuln/376167, for potential workarounds or additional mitigation details.

SQL Injection in SourceCodester Class and Exam Timetabling System (CVE-2026-14641)

hello@craftedsignal.io — Sat, 04 Jul 2026 19:23:20 +0000

A high-severity SQL injection vulnerability, tracked as CVE-2026-14641, has been identified in SourceCodester Class and Exam Timetabling System version 1.0. This flaw allows unauthenticated, remote attackers to execute arbitrary SQL commands by manipulating the 'ID' argument within the /edit_course.php file. The vulnerability stems from improper neutralization of special elements in SQL commands, specifically CWE-89. The exploit has been publicly disclosed and is actively available, increasing the risk of widespread exploitation. This vulnerability enables attackers to potentially read, modify, or delete data from the backend database, compromising data confidentiality and integrity. Defenders should prioritize patching and implementing robust input validation to mitigate this threat.

Attack Chain

An unauthenticated attacker crafts a malicious HTTP GET request targeting the /edit_course.php endpoint of the vulnerable SourceCodester Class and Exam Timetabling System.
The crafted request includes a specially malformed ID parameter in the URL query string, containing SQL injection payloads (e.g., ID=1%27%20UNION%20SELECT%20...).
The vulnerable /edit_course.php script processes the ID parameter without proper input sanitization or validation.
The application directly embeds the malicious ID parameter's value into a backend SQL query.
The database server executes the manipulated SQL query, which may bypass intended logic and allow the attacker to retrieve sensitive information or modify data.
The web server responds to the attacker's request, potentially disclosing sensitive database content (e.g., user credentials, system configurations, application data) within the HTTP response body.
The attacker parses the HTTP response to extract the compromised data, achieve data exfiltration, or modify database records.

Impact

Successful exploitation of CVE-2026-14641 can lead to significant data breaches, where attackers can read, modify, or delete sensitive information stored in the application's database. This includes user accounts, academic records, scheduling data, and potentially administrative credentials. While specific victim counts are not available, the widespread use of SourceCodester systems in educational settings suggests that successful attacks could impact student and staff privacy, disrupt academic operations, and lead to reputational damage for affected institutions. The CVSS 3.1 score of 7.3 (High) indicates low impact on confidentiality, integrity, and availability, but SQL injection commonly leads to more severe consequences like full database compromise or even arbitrary code execution under certain configurations.

Recommendation

Prioritize patching SourceCodester Class and Exam Timetabling System to a non-vulnerable version immediately to address CVE-2026-14641.
Deploy the provided Sigma rule to your SIEM solution to detect exploitation attempts against the /edit_course.php endpoint.
Ensure webserver logging (category: webserver) is enabled and configured to capture full HTTP request details, especially cs-uri-stem and cs-uri-query, to enable the rule.
Implement web application firewalls (WAFs) with rules designed to detect and block SQL injection payloads targeting HTTP GET parameters.