CVE-2026-36952: Online Thesis Archiving System SQLi Flaw

CVE-2026-36952 Overview

CVE-2026-36952 is a SQL Injection vulnerability affecting Sourcecodester Online Thesis Archiving System v1.0. The vulnerability exists in the file /otas/admin/curriculum/manage_curriculum.php, allowing attackers with high privileges to exploit improper input validation and potentially extract sensitive data from the underlying database.

Critical Impact

Authenticated attackers with administrative access can exploit this SQL injection flaw to read sensitive data from the database, potentially compromising thesis records, user credentials, and other confidential academic information.

Affected Products

• Sourcecodester Online Thesis Archiving System v1.0
• /otas/admin/curriculum/manage_curriculum.php endpoint

Discovery Timeline

• 2026-04-13 - CVE-2026-36952 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-36952

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) occurs in the curriculum management functionality of the Online Thesis Archiving System. The vulnerable endpoint /otas/admin/curriculum/manage_curriculum.php fails to properly sanitize user-supplied input before incorporating it into SQL queries. While the vulnerability requires high-privilege access (administrative credentials), successful exploitation allows an attacker to manipulate database queries to extract confidential information.

The attack is network-accessible, meaning it can be exploited remotely without user interaction. However, the impact is limited to confidentiality breaches with low severity—the attacker can read unauthorized data but cannot modify or delete database records.

Root Cause

The root cause of CVE-2026-36952 is improper input validation in the manage_curriculum.php file. User-supplied parameters are directly concatenated into SQL queries without adequate sanitization or the use of parameterized queries (prepared statements). This allows specially crafted input to alter the intended SQL logic, enabling unauthorized data retrieval.

Attack Vector

The attack vector is network-based, requiring authenticated access with administrative privileges. An attacker who has compromised or obtained administrative credentials can send malicious HTTP requests to the vulnerable endpoint. The injected SQL payload is processed by the backend database, returning sensitive data that should not be accessible through normal application functionality.

The vulnerability manifests in the curriculum management functionality where user input is incorporated into database queries. For detailed technical analysis and proof-of-concept information, see the GitHub SQL Injection Report.

Detection Methods for CVE-2026-36952

Indicators of Compromise

• Unusual SQL syntax or error messages in application logs related to /otas/admin/curriculum/manage_curriculum.php
• Unexpected queries containing SQL keywords such as UNION, SELECT, OR 1=1, or comment sequences (--, /**/)
• Administrative account activity from unfamiliar IP addresses or geographic locations
• Database query logs showing access patterns inconsistent with normal curriculum management operations

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting the /otas/admin/curriculum/ path
• Enable detailed logging for all database queries executed by the thesis archiving application
• Monitor for HTTP requests containing SQL metacharacters in parameters sent to manage_curriculum.php
• Deploy intrusion detection signatures specifically targeting SQL injection attempts in PHP web applications

Monitoring Recommendations

• Review web server access logs for requests to /otas/admin/curriculum/manage_curriculum.php with suspicious query string parameters
• Set up alerts for database errors that may indicate attempted SQL injection exploitation
• Monitor administrative user sessions for unusual activity patterns or data access beyond normal operational needs
• Implement real-time monitoring of database query execution times, as SQL injection attacks may cause anomalous query performance

How to Mitigate CVE-2026-36952

Immediate Actions Required

• Restrict access to the /otas/admin/curriculum/manage_curriculum.php endpoint to trusted IP addresses only
• Review and audit all administrative account credentials, rotating passwords for any potentially compromised accounts
• Implement a Web Application Firewall with SQL injection protection rules in front of the application
• Consider temporarily disabling the vulnerable curriculum management functionality until a patch is applied

Patch Information

No official vendor patch has been released at this time. Organizations using Sourcecodester Online Thesis Archiving System v1.0 should monitor for security updates and apply patches immediately when available. In the absence of an official fix, implement the workarounds below and consider engaging a qualified security professional to remediate the vulnerable code directly.

Workarounds

• Apply strict input validation on all user-controllable parameters in the curriculum management module
• Modify the vulnerable code to use parameterized queries (prepared statements) instead of direct string concatenation
• Implement additional authentication controls such as multi-factor authentication for administrative accounts
• Segment the database server from the web application server to limit lateral movement in case of compromise
• Consider deploying an application-layer firewall to filter malicious SQL injection payloads

# Example: Restrict access to admin panel via .htaccess
<Directory "/var/www/html/otas/admin/">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Directory>