Executive Summary
A SQL injection vulnerability, tracked as CVE-2026-90514, has been disclosed in SourceCodester School Registration and Fee System 1.0, a PHP-based student registration and billing application commonly deployed by small schools and administrative offices. The flaw sits in an unknown function of /bilal/normal/save_stud.php, where the Status argument is passed into a database query without proper sanitization.
CVSS Score: 7.3 (High, CVSS 3.1) — also rated 6.9 (Medium) under CVSS 4.0.
The vulnerability can be triggered remotely and does not require authentication, making it exploitable by any attacker with network access to a vulnerable instance. A proof-of-concept exploit is already published on GitHub, which sharply raises the urgency for affected operators.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-90514 |
| CWE | CWE-89 (SQL Injection) |
| CVSS 3.1 Score | 7.3 (High) |
| CVSS 4.0 Score | 6.9 (Medium) |
| Component | /bilal/normal/save_stud.php |
| Affected Parameter | Status |
| Attack Vector | Network (remote) |
| Authentication | None required |
| Exploit Status | Public PoC available on GitHub |
| Vendor Response | None at time of writing |
| Reserved / Published | 2026-09-12 / 2026-09-13 |
Affected Versions
| Product | Affected Versions | Fixed Version |
|---|---|---|
| SourceCodester School Registration and Fee System | 1.0 | Not yet published |
SourceCodester projects are community-contributed PHP applications frequently used as free, self-hosted templates — meaning patches and vendor support are typically minimal to nonexistent. No fixed release currently exists for this flaw.
Why This Matters
School registration systems store sensitive student and guardian records — names, contact details, enrollment status, and often fee/payment history. An unauthenticated SQL injection in this context is significant because:
- No credentials are needed — any network-positioned attacker can attempt exploitation directly against
save_stud.php. - The vulnerable endpoint is trivially discoverable via a Google dork (
inurl:bilal/normal/save_stud.php), lowering the bar for opportunistic mass scanning. - Exploitation is rated easy by vulnerability scoring services, and a working exploit is already public, which typically shortens the window between disclosure and mass exploitation attempts.
- A near-identical flaw (CVE-2026-90526) was disclosed the same day in the product's
/bilal/save_class.phpfile via theCategoryparameter — suggesting the codebase lacks input sanitization broadly, not just in this one endpoint.
Recommended Actions
- Identify exposure — confirm whether your instance of this software is reachable from the internet and check the installed version.
- Restrict network access to the application where possible; place it behind a VPN or IP allowlist if it does not need to be public-facing.
- Deploy WAF rules to detect and block SQL-injection payloads targeting the
Statusparameter and thesave_stud.phpendpoint specifically. - Monitor database and application logs for anomalous queries or unexpected access to student records.
- Since no vendor patch exists, consider migrating off this codebase or applying prepared-statement fixes locally if you rely on it in production.
- Rotate any credentials stored in or accessible via the affected database if compromise is suspected.