CVE-2026-5537: halex CourseSEL SQL Injection Vulnerability

CVE-2026-5537 Overview

A SQL Injection vulnerability has been identified in halex CourseSEL up to version 1.1.0. This vulnerability affects the check_sel function within the file Apps/Index/Controller/IndexController.class.php, which is part of the HTTP GET Parameter Handler component. An attacker can manipulate the seid argument to inject malicious SQL queries, enabling unauthorized database access. The vulnerability can be exploited remotely by authenticated users with low privileges.

Critical Impact

Successful exploitation allows attackers to extract, modify, or delete sensitive data from the backend database, potentially leading to complete database compromise and data exfiltration.

Affected Products

• halex CourseSEL versions up to and including 1.1.0
• Systems utilizing the IndexController.class.php component with HTTP GET parameter handling
• Deployments exposing the vulnerable check_sel function to network access

Discovery Timeline

• April 5, 2026 - CVE-2026-5537 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5537

Vulnerability Analysis

This SQL Injection vulnerability (CWE-74: Injection) occurs in the check_sel function within Apps/Index/Controller/IndexController.class.php. The function processes HTTP GET parameters without proper input sanitization or parameterized query implementation. When the seid parameter is passed to the application, it is directly incorporated into SQL queries, allowing attackers to inject arbitrary SQL code.

The exploit has been publicly disclosed, increasing the risk of active exploitation. The vendor was contacted regarding this disclosure but has not responded, leaving users without an official patch. Remote exploitation is possible, making this vulnerability particularly concerning for internet-facing deployments of CourseSEL.

Root Cause

The root cause of this vulnerability is improper input validation and the failure to use parameterized queries or prepared statements when processing the seid parameter in the check_sel function. User-supplied input from HTTP GET requests is directly concatenated into SQL query strings, enabling SQL Injection attacks.

Attack Vector

The attack is network-based and requires low privileges to execute. An attacker can craft malicious HTTP GET requests containing SQL Injection payloads in the seid parameter. The vulnerable check_sel function processes these requests without sanitization, allowing the injected SQL to execute against the backend database.

The vulnerability can be exploited by manipulating the seid parameter in HTTP GET requests to the affected endpoint. Attackers can craft payloads that extract database contents, bypass authentication mechanisms, or modify stored data. Technical details and proof-of-concept information are available in the GitHub SQL Injection Report.

Detection Methods for CVE-2026-5537

Indicators of Compromise

• Unusual SQL syntax patterns appearing in web server access logs for requests targeting IndexController.class.php
• HTTP GET requests with suspicious characters or SQL keywords in the seid parameter (e.g., UNION, SELECT, --, ', OR 1=1)
• Database logs showing unexpected queries or errors originating from the CourseSEL application
• Evidence of data exfiltration or unauthorized database modifications

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL Injection patterns in HTTP GET parameters
• Monitor application and database logs for anomalous query patterns or error messages indicating injection attempts
• Deploy network intrusion detection systems (IDS) with signatures targeting SQL Injection payloads
• Conduct regular security audits of HTTP request logs focusing on the seid parameter

Monitoring Recommendations

• Enable detailed logging for all HTTP requests to the vulnerable endpoint Apps/Index/Controller/IndexController.class.php
• Configure database audit logging to capture all queries executed by the CourseSEL application
• Set up real-time alerting for SQL error patterns that may indicate injection attempts
• Monitor for unusual data access patterns or bulk data retrieval from the database

How to Mitigate CVE-2026-5537

Immediate Actions Required

• Restrict network access to the vulnerable CourseSEL application to trusted IP addresses only
• Implement input validation and sanitization for all HTTP GET parameters, particularly seid
• Deploy a Web Application Firewall (WAF) with SQL Injection protection rules in front of the application
• Consider taking the vulnerable application offline until a proper fix can be implemented

Patch Information

No official patch is currently available from the vendor. The vendor was contacted about this vulnerability but did not respond. Organizations using halex CourseSEL should implement workarounds and consider alternative solutions. For additional vulnerability details, refer to the VulDB Vulnerability #355290 entry.

Workarounds

• Modify the check_sel function in IndexController.class.php to use parameterized queries or prepared statements
• Implement server-side input validation to reject seid parameter values containing SQL keywords or special characters
• Use application-layer firewalls to filter malicious requests before they reach the vulnerable component
• Limit database user privileges for the CourseSEL application to reduce the impact of successful exploitation

# Example WAF rule configuration for SQL Injection protection
# ModSecurity rule to block SQL Injection in seid parameter
SecRule ARGS:seid "@detectSQLi" \
    "id:1000,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in seid parameter',\
    tag:'attack-sqli'"