CVE-2026-90514: School Registration System SQL Injection

CVE-2026-90514 Overview

CVE-2026-90514 is a SQL injection vulnerability in SourceCodester School Registration and Fee System 1.0. The flaw resides in the /bilal/normal/save_stud.php script, where the Status parameter is passed to a database query without proper sanitization. Attackers can manipulate this argument to inject arbitrary SQL statements. The vulnerability is remotely exploitable and requires no authentication or user interaction. Public exploit details have been disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can inject SQL statements through the Status parameter in save_stud.php, potentially exposing or modifying student registration and fee data.

Affected Products

SourceCodester School Registration and Fee System 1.0
Deployments exposing /bilal/normal/save_stud.php to untrusted networks
Downstream forks or derivative projects reusing the vulnerable code

Discovery Timeline

2026-09-13 - CVE-2026-90514 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90514

Vulnerability Analysis

The vulnerability is a classic SQL injection in the student save workflow of the School Registration and Fee System. The save_stud.php endpoint accepts a Status argument from the HTTP request and concatenates it into a database query. Because the code does not use prepared statements or input validation, an attacker can break out of the intended query context and append arbitrary SQL. Successful exploitation may allow attackers to read, alter, or delete records in the underlying database, depending on database user privileges. The flaw is reachable remotely over the network without credentials, which lowers the barrier for automated exploitation. Impact is bounded by the limited-scope confidentiality, integrity, and availability effects reflected in the CVSS metrics.

Root Cause

The root cause is improper neutralization of special elements in a downstream SQL query [CWE-74]. The application trusts the Status request parameter and injects it directly into query text. There is no parameterization, type enforcement, or allow-list validation before the value reaches the database driver.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to /bilal/normal/save_stud.php with a malicious Status value. The injected payload alters the resulting SQL statement, enabling data extraction through techniques such as UNION-based, boolean-based, or time-based blind injection. Because the exploit has been publicly disclosed, opportunistic scanning is a realistic threat. See the GitHub CVE Issue Discussion and VulDB entry for CVE-2026-90514 for public technical context.

No verified proof-of-concept code is included here. Refer to the linked advisories for reproduction details.

Detection Methods for CVE-2026-90514

Indicators of Compromise

HTTP requests targeting /bilal/normal/save_stud.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or OR 1=1 in the Status parameter.
Web server logs showing repeated POST or GET requests to save_stud.php from a single source with varying Status values.
Database error messages surfaced in HTTP responses referencing MySQL syntax errors triggered by injected input.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection patterns on parameters submitted to save_stud.php.
Enable database query logging and alert on unusual query structures originating from the application account used by the School Registration and Fee System.
Correlate HTTP access logs with database audit logs to identify anomalous data reads following requests to the vulnerable endpoint.

Monitoring Recommendations

Baseline normal parameter values for Status and alert on deviations such as encoded payloads or unexpected string length.
Monitor outbound egress from the database host for signs of data exfiltration following suspicious save_stud.php traffic.
Track authentication and privilege-change activity in the application database to detect post-exploitation tampering.

How to Mitigate CVE-2026-90514

Immediate Actions Required

Restrict network access to the /bilal/normal/save_stud.php endpoint to trusted administrative networks until a fix is deployed.
Deploy WAF rules that block SQL injection payloads targeting the Status parameter.
Rotate database credentials used by the application and confirm that the database account has only the minimum privileges required.

Patch Information

No official vendor patch has been published at the time of writing. Administrators should monitor the SourceCodester project site and the VulDB vulnerability record #403101 for updates. Where source access is available, modify save_stud.php to use parameterized queries or prepared statements when handling the Status value.

Workarounds

Wrap the vulnerable endpoint behind an authenticated reverse proxy to prevent unauthenticated access.
Implement server-side allow-list validation that rejects any Status value not matching the expected enumeration.
If the endpoint is not required for production use, disable or remove save_stud.php from the deployed application.

bash

# Example nginx configuration to restrict access to the vulnerable endpoint
location = /bilal/normal/save_stud.php {
    allow 10.0.0.0/8;
    deny all;
}