CVE-2026-90515: School Registration System SQL Injection

CVE-2026-90515 is a SQL injection vulnerability in SourceCodester School Registration and Fee System 1.0 affecting the delete_stud.php file. Attackers can exploit the selector[] parameter remotely to inject malicious SQL commands. This article covers technical details, attack vectors, and mitigation strategies.

CVE-2026-90515 Overview

CVE-2026-90515 is a SQL injection vulnerability in SourceCodester School Registration and Fee System 1.0. The flaw resides in the /bilal/normal/delete_stud.php script, where the selector[] argument is passed to a database query without proper sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements against the backend database. The issue is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. Public disclosure of the exploit details has occurred through third-party vulnerability databases, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact
Unauthenticated remote attackers can inject SQL commands through the selector[] parameter of delete_stud.php, potentially exposing or altering student registration data.

Affected Products

SourceCodester School Registration and Fee System 1.0
Component: /bilal/normal/delete_stud.php
Vulnerable parameter: selector[]

Discovery Timeline

2026-09-13 - CVE-2026-90515 published to NVD
2026-09-20 - Last updated in NVD database

Technical Details for CVE-2026-90515

Vulnerability Analysis

The vulnerability exists in the student deletion handler delete_stud.php shipped with the School Registration and Fee System 1.0. The script accepts an array parameter named selector[], which represents the identifiers of student records selected for deletion. The application concatenates these values directly into a SQL query executed against the underlying MySQL database. Because no parameterized statements or input validation are applied, an attacker controls part of the query structure. The flaw requires no authentication and can be triggered over the network with a single HTTP request. Successful exploitation impacts the confidentiality, integrity, and availability of stored data at a limited scope, consistent with the CWE-74 classification.

Root Cause

The root cause is improper neutralization of user-supplied input before it is embedded in a SQL statement. The selector[] array elements are trusted as safe integers or identifiers but are never validated, cast, or bound as prepared-statement parameters. Any element containing SQL metacharacters becomes part of the executed query.

Attack Vector

Exploitation occurs remotely through an HTTP request to /bilal/normal/delete_stud.php. An attacker submits a crafted selector[] value containing SQL syntax, such as boolean-based, UNION-based, or time-based injection payloads. The malicious query executes with the privileges of the web application's database user. Additional details are available in the VulDB entry for CVE-2026-90515 and the public GitHub issue.

No verified proof-of-concept code is republished here. Refer to the referenced advisories for exploitation specifics.

Detection Methods for CVE-2026-90515

Indicators of Compromise

HTTP POST or GET requests targeting /bilal/normal/delete_stud.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or comment sequences within selector[] values.
Unexpected database errors, extended query response times, or malformed responses originating from the delete_stud.php endpoint.
Web server access logs showing repeated requests to delete_stud.php from unauthenticated sources.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection payloads in the selector[] parameter of delete_stud.php.
Enable database query logging and alert on unusual DELETE, UNION, or INFORMATION_SCHEMA operations initiated by the application's database account.
Correlate anomalous HTTP request bodies with subsequent database errors to identify probing attempts.

Monitoring Recommendations

Ingest web server and database logs into a centralized analytics platform for pattern-based detection of injection attempts.
Baseline normal request rates to delete_stud.php and alert on volumetric spikes indicative of automated scanners.
Monitor outbound network traffic from the web server for signs of data exfiltration following suspicious requests.

How to Mitigate CVE-2026-90515

Immediate Actions Required

Restrict network exposure of the School Registration and Fee System 1.0 to trusted internal networks or place it behind a VPN.
Disable or remove the delete_stud.php endpoint if it is not required for operations.
Enforce authentication and authorization checks in front of administrative pages using reverse-proxy access controls.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-90515. Users should monitor the SourceCodester website for updates and consider migrating to a maintained alternative. Until an official fix is released, apply the workarounds below and modify the source of delete_stud.php to use parameterized queries with PDO or MySQLi prepared statements.

Workarounds

Modify delete_stud.php to validate that each selector[] element is a positive integer before use in a SQL statement.
Replace string concatenation with prepared statements using bound parameters for all database queries.
Deploy a WAF rule blocking SQL metacharacters in the selector[] parameter as a compensating control.
Apply least-privilege permissions to the application's database account, restricting it from destructive operations beyond what is required.

bash

# Example ModSecurity rule blocking SQL metacharacters in selector[] on delete_stud.php
SecRule REQUEST_URI "@endsWith /bilal/normal/delete_stud.php" \
    "phase:2,chain,deny,status:403,id:1029015,\
    msg:'Potential SQL Injection in selector[] parameter'"
    SecRule ARGS_NAMES|ARGS "@rx (?i)(union\s+select|sleep\s*\(|--|\bor\b\s+1=1|')" \
        "t:none,t:urlDecodeUni"