CVE-2026-90526: School Registration System SQL Injection

CVE-2026-90526 is a SQL injection vulnerability in SourceCodester School Registration and Fee System 1.0 affecting the save_class.php file. Attackers can exploit this remotely to manipulate databases. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-90526 Overview

CVE-2026-90526 is a SQL injection vulnerability in SourceCodester School Registration and Fee System 1.0. The flaw resides in the /bilal/save_class.php script, where the Category request parameter is passed to a SQL query without proper sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements. Exploitation requires no authentication and no user interaction. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic scanning and abuse against exposed installations.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL against the backend database, exposing student, class, and fee records and potentially enabling data tampering.

Affected Products

SourceCodester School Registration and Fee System 1.0
The vulnerable component is /bilal/save_class.php
The vulnerable parameter is Category

Discovery Timeline

2026-09-13 - CVE-2026-90526 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90526

Vulnerability Analysis

The vulnerability is a classic SQL Injection categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The save_class.php endpoint accepts a Category parameter from the HTTP request and concatenates it directly into a SQL statement. Because no parameterized queries or input validation are applied, attacker-controlled input alters the query structure.

Successful exploitation allows attackers to read, modify, or delete records in the database backing the school registration workflow. Depending on database privileges, an attacker may also enumerate the schema, dump credentials stored in application tables, or pivot toward writing files via INTO OUTFILE where MySQL configuration permits.

Root Cause

The root cause is the absence of prepared statements and input sanitization in the save_class.php handler. User-supplied data is trusted and inserted into SQL logic verbatim, breaking the separation between code and data expected by the database driver.

Attack Vector

Exploitation is performed over the network against the vulnerable PHP endpoint. An attacker sends a crafted HTTP request in which the Category field carries SQL syntax such as boolean, UNION, or time-based payloads. No credentials are required, and the request can originate from any host that can reach the web application.

No verified exploit code is published as a structured PoC in the enriched data. Details are available on the GitHub CVE Issue Discussion and the VulDB CVE-2026-90526 Entry.

Detection Methods for CVE-2026-90526

Indicators of Compromise

HTTP POST or GET requests to /bilal/save_class.php containing SQL meta-characters in the Category parameter, including single quotes, --, UNION SELECT, or SLEEP(.
Web server logs showing repeated requests to save_class.php from a single source with varying Category values consistent with automated SQLi tooling.
Unexpected database errors surfaced in PHP application logs referencing the save_class.php script.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the Category parameter for SQL injection signatures and block requests targeting /bilal/save_class.php.
Enable database query logging and alert on anomalous query shapes originating from the school registration application, such as unions across unrelated tables.
Correlate web access logs with database error events to surface probing activity before successful exploitation.

Monitoring Recommendations

Monitor for spikes in 500-series HTTP responses from the application, which often indicate SQL syntax errors triggered by injection attempts.
Track outbound data volume from the database host to detect bulk extraction following successful exploitation.
Review authentication tables and administrative accounts for unauthorized additions or password changes on a scheduled basis.

How to Mitigate CVE-2026-90526

Immediate Actions Required

Restrict network access to the School Registration and Fee System so only trusted networks can reach /bilal/save_class.php.
Apply virtual patching at the WAF layer to reject requests where the Category parameter contains SQL meta-characters.
Rotate database credentials and audit database accounts used by the application for excessive privileges.

Patch Information

At the time of publication, no official vendor patch is referenced in the NVD entry for SourceCodester School Registration and Fee System 1.0. Administrators should monitor the SourceCodester Security Resources portal and the VulDB Vulnerability #403116 tracker for remediation updates. Until an upstream fix is released, code-level remediation should replace string-concatenated SQL in save_class.php with parameterized queries using PDO or MySQLi prepared statements.

Workarounds

Take the application offline or place it behind authenticated access controls until a fix is available.
Configure the database account used by the application with the least privileges required, denying FILE, CREATE, and DROP privileges where possible.
Add server-side input validation that rejects any Category value not matching an expected allow-list of characters.

bash

# Example ModSecurity rule to block SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /bilal/save_class.php" \
    "id:1029005,phase:2,deny,status:403,\
    chain,msg:'Block SQLi attempt against save_class.php Category param'"
    SecRule ARGS:Category "@detectSQLi" "t:none,t:urlDecodeUni"