CVE-2026-36950: Online Thesis Archiving System SQLi Flaw

CVE-2026-36950 Overview

CVE-2026-36950 is a SQL Injection vulnerability affecting Sourcecodester Online Thesis Archiving System v1.0. The vulnerability exists in the /otas/projects_per_department.php endpoint, allowing attackers with high privileges to perform SQL injection attacks against the underlying database. This vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact

Authenticated attackers with high-level privileges can exploit this SQL injection vulnerability to extract sensitive data from the database, potentially exposing thesis documents, user credentials, and other confidential academic information stored in the Online Thesis Archiving System.

Affected Products

• Sourcecodester Online Thesis Archiving System v1.0

Discovery Timeline

• 2026-04-13 - CVE CVE-2026-36950 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-36950

Vulnerability Analysis

This SQL Injection vulnerability occurs in the projects_per_department.php file of the Online Thesis Archiving System. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries. While the vulnerability requires high privileges to exploit (PR:H), it can be leveraged over the network without user interaction, allowing an authenticated attacker with elevated permissions to manipulate database queries and extract confidential information from the system.

The impact is limited to confidentiality breaches, meaning attackers can read unauthorized data but cannot modify database contents or disrupt system availability through this specific vulnerability.

Root Cause

The root cause of this vulnerability is improper input validation and lack of parameterized queries in the projects_per_department.php script. User-controlled input is directly concatenated into SQL statements without proper sanitization or the use of prepared statements, creating an injection point that can be exploited to manipulate the query logic.

Attack Vector

The attack vector is network-based, requiring authenticated access with high-level privileges. An attacker must first obtain or compromise an account with sufficient permissions to access the vulnerable endpoint at /otas/projects_per_department.php. Once authenticated, the attacker can inject malicious SQL syntax through vulnerable parameters to manipulate database queries and extract sensitive information.

The vulnerability allows for data exfiltration through techniques such as UNION-based injection, error-based injection, or blind SQL injection depending on the application's error handling configuration. Technical details about the specific injection method can be found in the GitHub SQL Injection Report.

Detection Methods for CVE-2026-36950

Indicators of Compromise

• Unusual SQL error messages appearing in application logs related to the projects_per_department.php endpoint
• Database query logs showing malformed or suspicious queries containing SQL keywords like UNION, SELECT, OR 1=1, or comment sequences
• Unexpected data access patterns from high-privilege user accounts accessing the thesis archiving system
• Web server access logs showing requests to /otas/projects_per_department.php with encoded or malformed parameters

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting the affected endpoint
• Enable database query logging and monitor for anomalous query structures or unauthorized data access attempts
• Configure intrusion detection systems (IDS) to alert on SQL injection attack signatures in HTTP traffic
• Review application logs for repeated failed queries or SQL syntax errors that may indicate exploitation attempts

Monitoring Recommendations

• Monitor authentication logs for suspicious activity from high-privilege accounts that have access to the vulnerable functionality
• Implement real-time alerting for any SQL errors generated by the projects_per_department.php script
• Track and baseline normal data access patterns to identify anomalous database query behavior
• Set up file integrity monitoring on the affected PHP files to detect unauthorized modifications

How to Mitigate CVE-2026-36950

Immediate Actions Required

• Restrict access to the /otas/projects_per_department.php endpoint to only essential users until a patch is available
• Implement additional input validation and filtering at the web application firewall level
• Review and audit high-privilege accounts that have access to the vulnerable functionality
• Consider taking the affected functionality offline if the system handles sensitive academic data

Patch Information

As of the last update on 2026-04-14, no official vendor patch has been released for this vulnerability. System administrators should monitor the Sourcecodester website and community forums for security updates. Given the nature of Sourcecodester projects as educational/demonstration code, organizations using this system in production environments should consider implementing the vulnerability fix manually or migrating to a more actively maintained thesis management solution.

Workarounds

• Implement prepared statements and parameterized queries in the projects_per_department.php file to prevent SQL injection
• Deploy a Web Application Firewall (WAF) configured with SQL injection detection rules to filter malicious requests
• Restrict network access to the application to trusted IP ranges only using firewall rules
• Disable or remove the vulnerable endpoint if the functionality is not critical to operations

# Apache .htaccess configuration to restrict access to vulnerable endpoint
<Files "projects_per_department.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
</Files>