CVE-2026-2090: Janobe Online Class Record System SQLi Flaw

CVE-2026-2090 Overview

A SQL Injection vulnerability has been identified in SourceCodester Online Class Record System version 1.0. This issue affects the file /admin/message/search.php, where manipulation of the term argument can lead to SQL injection attacks. The vulnerability can be exploited remotely without authentication, and the exploit has been publicly disclosed and may be actively utilized by threat actors.

Critical Impact

Unauthenticated attackers can remotely exploit this SQL injection vulnerability to potentially extract sensitive data, modify database contents, or compromise the underlying database server through the vulnerable search functionality.

Affected Products

• Janobe Online Class Record System 1.0
• SourceCodester Online Class Record System applications using /admin/message/search.php

Discovery Timeline

• 2026-02-07 - CVE CVE-2026-2090 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-2090

Vulnerability Analysis

This SQL Injection vulnerability (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) exists in the Online Class Record System's administrative message search functionality. The vulnerable endpoint /admin/message/search.php fails to properly sanitize user-supplied input in the term parameter before incorporating it into SQL queries.

When a user submits a search request, the application directly concatenates the term parameter value into the SQL query without adequate input validation or parameterized queries. This allows attackers to inject arbitrary SQL commands that the database server will execute with the privileges of the application's database user.

The vulnerability is accessible over the network and requires no authentication or user interaction to exploit, making it particularly dangerous for exposed deployments. While the confidentiality, integrity, and availability impacts are each rated as low individually, the combination of network accessibility and no required privileges makes this a significant security concern.

Root Cause

The root cause of this vulnerability is the improper handling of user input in the search functionality. The application fails to implement proper input validation, output encoding, or parameterized queries when processing the term argument. Instead of treating user input as untrusted data, the application directly embeds it into SQL query strings, creating a classic SQL injection attack surface.

Attack Vector

The attack vector for CVE-2026-2090 is network-based, allowing remote exploitation. An attacker can craft malicious HTTP requests to the /admin/message/search.php endpoint with specially crafted SQL injection payloads in the term parameter. The vulnerable search functionality processes these requests and executes the injected SQL commands against the backend database.

Successful exploitation could allow attackers to:

• Extract sensitive information from the database including user credentials and student records
• Modify or delete database records
• Potentially escalate to command execution depending on database configuration
• Enumerate database structure and contents

The vulnerability mechanism involves unsanitized user input being passed directly to SQL query construction. When a malicious term parameter containing SQL metacharacters is submitted, the database interprets the injected content as SQL commands rather than literal search terms. For detailed technical analysis, refer to the GitHub Issue Discussion and VulDB entry #344657.

Detection Methods for CVE-2026-2090

Indicators of Compromise

• Unusual or malformed requests to /admin/message/search.php containing SQL syntax characters such as single quotes, semicolons, or SQL keywords
• Database error messages appearing in application logs or responses indicating query failures
• Abnormal database query patterns or execution times from the web application
• Unexpected data access or extraction patterns in database audit logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the term parameter
• Monitor HTTP access logs for requests to /admin/message/search.php containing suspicious characters or SQL keywords
• Enable database query logging and alert on queries with unusual structures or execution patterns
• Deploy intrusion detection signatures targeting common SQL injection attack strings

Monitoring Recommendations

• Configure real-time alerting for requests to the vulnerable endpoint containing SQL injection indicators
• Establish baseline database activity patterns and alert on deviations that may indicate data exfiltration
• Monitor application error logs for database-related exceptions that could indicate exploitation attempts
• Review web server access logs regularly for reconnaissance or exploitation activity targeting the search functionality

How to Mitigate CVE-2026-2090

Immediate Actions Required

• Restrict access to /admin/message/search.php through network controls or authentication requirements until a patch is available
• Deploy Web Application Firewall rules to filter SQL injection attempts targeting the term parameter
• Consider temporarily disabling the message search functionality if it is not business-critical
• Audit database logs for signs of prior exploitation and potential data compromise

Patch Information

No official vendor patch has been identified for this vulnerability at this time. Organizations using the affected software should monitor SourceCodester for security updates and consider the workarounds listed below. Additional vulnerability details are available through VulDB #344657 and the GitHub Issue Discussion.

Workarounds

• Implement input validation to reject requests containing SQL metacharacters in the term parameter
• Deploy a reverse proxy or WAF with SQL injection filtering capabilities in front of the application
• Restrict network access to the administrative interface to trusted IP addresses only
• Consider replacing the vulnerable search functionality with a properly parameterized implementation

If modifying the application code is possible, the recommended mitigation is to implement parameterized queries (prepared statements) for all database interactions. The vulnerable code should use bound parameters rather than string concatenation to build SQL queries, ensuring user input is never interpreted as SQL commands.