CVE-2026-90877: Faculty Clearance System SQL Injection

CVE-2026-90877 Overview

CVE-2026-90877 is a SQL injection vulnerability in SourceCodester Online Faculty Clearance System 1.0. The flaw resides in the /update_requirement_status.php script, where the haydi parameter is passed to the backend database without proper sanitization. A remote attacker can manipulate this parameter to inject arbitrary SQL statements. No authentication or user interaction is required to trigger the issue. Public exploit details have been disclosed, increasing the likelihood of opportunistic exploitation against exposed installations of this web application.

Critical Impact
Unauthenticated remote attackers can inject SQL into the haydi parameter of /update_requirement_status.php, enabling database read, modification, or corruption of faculty clearance records.

Affected Products

SourceCodester Online Faculty Clearance System 1.0
Vulnerable endpoint: /update_requirement_status.php
Vulnerable parameter: haydi

Discovery Timeline

2026-09-15 - CVE-2026-90877 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90877

Vulnerability Analysis

The vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component, specifically manifesting as SQL injection. The /update_requirement_status.php script accepts the haydi request parameter and concatenates its value into a SQL statement executed against the backing database. Because the application does not use parameterized queries or input validation, attacker-controlled SQL fragments are interpreted as part of the query. Successful exploitation allows read and write operations against faculty clearance records, credential tables, and any other data reachable by the application's database user.

Root Cause

The root cause is unsanitized user input flowing into a dynamically constructed SQL statement. The haydi parameter, likely used to identify a requirement or status row, is inserted directly into the query string without prepared statements, escaping, or type coercion. This design pattern is common in legacy PHP applications and violates fundamental input handling practices.

Attack Vector

An attacker sends a crafted HTTP request to /update_requirement_status.php supplying a malicious value in the haydi parameter. The attack is network-based, requires no authentication, and needs no user interaction. Because the endpoint appears to perform an update operation, injection payloads can be used for boolean-based, time-based blind, or UNION-based extraction, as well as data modification. Public disclosure of exploit details lowers the barrier to weaponization by opportunistic actors and automated scanners.

No verified proof-of-concept code is published in the enriched data set. Refer to the VulDB CVE Record and GitHub Issue Discussion for additional technical context.

Detection Methods for CVE-2026-90877

Indicators of Compromise

HTTP requests to /update_requirement_status.php containing SQL metacharacters such as ', ", --, ;, UNION, SLEEP(, or BENCHMARK( in the haydi parameter.
Web server or PHP error logs referencing SQL syntax errors originating from update_requirement_status.php.
Unexpected modifications to faculty clearance, requirement status, or user tables in the application database.
Outbound connections or INTO OUTFILE write operations originating from the database server.

Detection Strategies

Deploy a web application firewall (WAF) rule set to flag SQL injection patterns targeting the haydi parameter and the update_requirement_status.php endpoint.
Enable database query logging and alert on anomalous statements referencing multiple tables, UNION SELECT, or timing functions from the application account.
Correlate HTTP access logs with database audit logs to detect malformed queries triggered by web requests.

Monitoring Recommendations

Monitor authentication and privilege changes on the application database user for signs of post-exploitation activity.
Track outbound traffic from the web server and database host to identify data exfiltration channels.
Baseline normal request volume against /update_requirement_status.php and alert on spikes or scanner-like patterns.

How to Mitigate CVE-2026-90877

Immediate Actions Required

Restrict network access to the Online Faculty Clearance System behind VPN or IP allow-lists until a patch is applied.
Deploy WAF signatures to block SQL injection payloads targeting the haydi parameter on /update_requirement_status.php.
Rotate database credentials used by the application and audit the database account's privileges, removing write access where not required.
Review database and web logs for signs of prior exploitation.

Patch Information

No official vendor patch is listed in the enriched CVE data at the time of publication. Administrators should monitor the SourceCodester project page and the VulDB Vulnerability Details record for remediation updates. Until a fix is released, mitigating controls and code-level fixes are the primary options.

Workarounds

Modify update_requirement_status.php to use parameterized queries or prepared statements via PDO or MySQLi with bound parameters for the haydi value.
Enforce strict server-side input validation, restricting haydi to expected data types such as integer identifiers.
Apply the principle of least privilege to the database account so injected statements cannot access sensitive tables or execute administrative commands.
Temporarily disable the affected endpoint if it is not required for daily operations.

bash

# Example WAF-style filter blocking SQLi patterns in the haydi parameter
# ModSecurity rule illustration
SecRule ARGS:haydi "@rx (?i)(union(\s|\+)+select|sleep\(|benchmark\(|--|;|')" \
  "id:1029087,phase:2,deny,status:403,msg:'Possible SQLi against update_requirement_status.php (CVE-2026-90877)'"