CVE-2026-90876: Online Faculty Clearance System SQL Injection

CVE-2026-90876 Overview

CVE-2026-90876 is a SQL injection vulnerability in SourceCodester Online Faculty Clearance System 1.0. The flaw resides in the /delete_requirement.php script, where the ID parameter is passed to a database query without proper sanitization. Attackers can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is remotely exploitable, requires no authentication, and no user interaction. Public disclosure of the exploit details increases the likelihood of opportunistic attacks against exposed installations. The weakness is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Unauthenticated remote attackers can inject SQL statements through the ID parameter of /delete_requirement.php, enabling unauthorized read, modification, or deletion of database records in the faculty clearance system.

Affected Products

SourceCodester Online Faculty Clearance System 1.0
Deployments using the vulnerable /delete_requirement.php endpoint
Any forked or derivative codebases that inherit the affected script

Discovery Timeline

2026-09-15 - CVE-2026-90876 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90876

Vulnerability Analysis

The vulnerability affects the delete_requirement.php script in the Online Faculty Clearance System web application. The endpoint accepts an ID parameter that is incorporated directly into a SQL statement used to delete a requirement record. Because input is not validated, escaped, or parameterized, an attacker can append or alter SQL syntax before it reaches the database engine.

Exploitation requires only network access to the web application. No credentials or user interaction are needed, which broadens the attack surface to any exposed instance. Successful injection can enumerate the database schema, extract sensitive faculty and clearance data, or manipulate records that support the clearance workflow.

The EPSS probability is 0.269%, reflecting current exploitation likelihood over the next 30 days. However, publicly available exploit details lower the bar for opportunistic attackers scanning for vulnerable PHP applications.

Root Cause

The root cause is improper neutralization of user-supplied input passed to a downstream SQL interpreter [CWE-74]. The delete_requirement.php handler concatenates the ID request parameter into a SQL query string instead of using prepared statements with bound parameters. This design allows attacker-controlled data to be interpreted as SQL syntax.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to /delete_requirement.php with a malicious value in the ID parameter. The payload can terminate the intended query and append additional SQL clauses such as UNION SELECT statements for data exfiltration or stacked queries for record manipulation. Because the application is web-facing, the attack can be launched remotely across the internet or an internal network segment.

// No verified exploit code is published. Technical details are available in the referenced advisories:
// - https://github.com/OnlyCMJB/cve/issues/2
// - https://vuldb.com/cve/CVE-2026-90876

Detection Methods for CVE-2026-90876

Indicators of Compromise

Web server access logs containing requests to /delete_requirement.php with SQL metacharacters such as ', ", --, ;, UNION, or SELECT in the ID parameter.
Unusual database errors returned by the application, especially syntax errors referencing the ID value.
Unexpected deletions or modifications of requirement records in the clearance database.
Outbound connections from the web server to unfamiliar hosts following anomalous requests to the affected endpoint.

Detection Strategies

Deploy signature-based detection in a web application firewall (WAF) to flag SQL injection patterns targeting the ID parameter of delete_requirement.php.
Enable database query logging and alert on non-parameterized queries or queries containing tautologies such as OR 1=1.
Correlate HTTP request logs with database audit logs to identify suspicious request-to-query sequences.

Monitoring Recommendations

Monitor request rate and payload entropy for the /delete_requirement.php endpoint to detect automated scanning.
Alert on authentication-free access to administrative or data-modification endpoints from external IP ranges.
Track error response codes (HTTP 500, database exception traces) that may indicate injection probing.

How to Mitigate CVE-2026-90876

Immediate Actions Required

Restrict network access to the Online Faculty Clearance System to trusted networks or place it behind an authenticated reverse proxy.
Deploy WAF rules that block SQL injection patterns targeting the ID parameter of delete_requirement.php.
Audit database accounts used by the application and enforce least-privilege permissions so injection cannot escalate to schema-wide operations.
Review web server and database logs for prior exploitation attempts against the affected endpoint.

Patch Information

No official vendor patch has been published in the referenced advisories at the time of NVD disclosure. Administrators should monitor the SourceCodester website and the VulDB CVE-2026-90876 entry for updates. Until a fix is released, apply the workarounds below or replace the vulnerable script with a version that uses prepared statements.

Workarounds

Modify delete_requirement.php to use PDO or mysqli prepared statements with bound parameters for the ID value.
Enforce server-side input validation to ensure the ID parameter is a positive integer before it reaches any SQL query.
Restrict the affected endpoint to authenticated administrative sessions using existing session controls in the application.
Take the application offline if it cannot be patched or hardened and no compensating controls are available.

bash

# Example: block SQL metacharacters in the ID parameter using ModSecurity
SecRule ARGS:ID "@rx [\'\"\;\-]|(?i)(union|select|insert|update|delete)" \
    "id:1029876,phase:2,deny,status:403,msg:'CVE-2026-90876 SQLi attempt on delete_requirement.php'"