CVE-2026-90515: SourceCodester School Registration and Fee System delete_stud.php sql injection
A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/deletestud.php. Executing a manipulation of the argument selector[] can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of SourceCodester School Registration and Fee System 1.0 that expose the /bilal/normal/delete_stud.php endpoint remotely are in scope. The supplied information does not identify any authentication requirement, and the vector is network-accessible.
What does an attacker need to exploit it?
An attacker needs to send a crafted value in the selector[] argument to the affected delete_stud.php endpoint. The attack has low complexity, requires no user interaction, and publicly disclosed exploit information may be available.
What is the likely impact if exploitation succeeds?
The vulnerability is SQL injection with low assessed impact to confidentiality, integrity, and availability. Successful exploitation may allow an attacker to affect data handled by the vulnerable SQL operation.
How can I check whether an installation is affected?
Confirm whether the deployment is SourceCodester School Registration and Fee System version 1.0 and whether /bilal/normal/delete_stud.php is present and accepts the selector[] parameter. The provided data does not identify a fixed version or a vendor mitigation.