CVE-2026-91004: Faculty Clearance System SQL Injection

CVE-2026-91004 Overview

CVE-2026-91004 is a SQL injection vulnerability in SourceCodester Online Faculty Clearance System 1.0. The flaw resides in the /delete_faculty1.php script, where the ID parameter is passed to a database query without proper sanitization. An unauthenticated remote attacker can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is categorized under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Remote attackers can execute arbitrary SQL queries against the application database without authentication, enabling data theft, record deletion, or manipulation of faculty clearance records.

Affected Products

SourceCodester Online Faculty Clearance System 1.0
Vulnerable file: /delete_faculty1.php
Vulnerable parameter: ID

Discovery Timeline

2026-09-15 - CVE-2026-91004 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91004

Vulnerability Analysis

The vulnerability is a classic first-order SQL injection in a PHP endpoint that handles faculty deletion. The /delete_faculty1.php script accepts an ID argument via HTTP request and concatenates it directly into a SQL statement executed against the backend database. Because the parameter is neither type-cast nor bound as a prepared statement placeholder, attackers can break out of the intended query context and append arbitrary SQL clauses.

Exploitation requires no authentication and no user interaction. The attack traverses the network stack directly against the vulnerable PHP endpoint. Successful exploitation exposes database contents, allows tampering with clearance records, and can be chained with UNION SELECT payloads to enumerate administrative credentials stored in adjacent tables.

Root Cause

The root cause is the absence of parameterized queries and input validation on the ID parameter within /delete_faculty1.php. The application trusts client-supplied input and interpolates it directly into a DELETE statement, violating the separation between code and data that prepared statements enforce.

Attack Vector

An attacker sends a crafted HTTP request to /delete_faculty1.php supplying a malicious value for the ID argument. Because the endpoint accepts unauthenticated requests over the network, exploitation is trivial once the vulnerable instance is reachable. Public disclosure through the VulDB Vulnerability Details and GitHub Issue Discussion provides step-by-step details that lower the barrier for opportunistic exploitation.

The vulnerability manifests when the ID parameter is appended to a DELETE FROM ... WHERE id= clause without sanitization. See the referenced advisories for reproduction details; no verified proof-of-concept code is republished here.

Detection Methods for CVE-2026-91004

Indicators of Compromise

HTTP requests to /delete_faculty1.php containing SQL metacharacters such as single quotes, --, #, UNION, SELECT, or OR 1=1 in the ID parameter.
Unexpected DELETE operations against the faculty table or missing faculty records without corresponding administrative activity.
Web server access logs showing sequential probing of numeric ID values followed by malformed payloads from a single source IP.

Detection Strategies

Deploy web application firewall signatures that inspect the ID query-string and POST parameter for SQL injection patterns targeting /delete_faculty1.php.
Enable database query logging and alert on DELETE statements originating from the faculty clearance application that contain unusual WHERE clause structures.
Correlate 500-series HTTP responses from the vulnerable endpoint with subsequent successful 200 responses, which often indicate successful injection tuning.

Monitoring Recommendations

Ingest PHP application and web server logs into a centralized SIEM to enable retrospective search for exploitation attempts referencing delete_faculty1.php.
Baseline normal request volume and parameter cardinality for the endpoint, and alert on statistically significant deviations.
Monitor outbound database connections for unexpected schema-enumeration queries such as reads against information_schema.tables originating from the web application user.

How to Mitigate CVE-2026-91004

Immediate Actions Required

Restrict network access to the Online Faculty Clearance System behind a VPN or IP allow-list until a vendor patch is available.
Deploy a WAF rule that blocks requests to /delete_faculty1.php containing SQL metacharacters in the ID parameter.
Rotate database credentials used by the application and audit the faculty and user tables for unauthorized deletions or modifications.

Patch Information

No official vendor patch has been referenced for SourceCodester Online Faculty Clearance System 1.0 at the time of publication. Administrators should monitor the SourceCodester Resource Hub and the VulDB CVE Summary for updates. Until a fix is issued, code owners forking the project should refactor /delete_faculty1.php to use prepared statements with bound parameters and cast the ID value to an integer before use.

Workarounds

Enforce server-side type-casting of the ID parameter to an integer in /delete_faculty1.php before it reaches any SQL query.
Replace inline query concatenation with PDO or MySQLi prepared statements using bound parameters.
Apply the principle of least privilege to the database account used by the application, removing DROP, ALTER, and cross-database SELECT permissions.
Disable or remove the vulnerable script if the delete functionality is not required in the deployment.

bash

# Example WAF rule pattern (ModSecurity-style)
SecRule REQUEST_URI "@contains /delete_faculty1.php" \
  "chain,deny,status:403,id:1091004,msg:'CVE-2026-91004 SQLi attempt'"
  SecRule ARGS:ID "!@rx ^[0-9]+$" "t:none"