CVE-2026-2089 in Online Class Record System
Summary
by MITRE • 02/07/2026
A vulnerability was found in SourceCodester Online Class Record System 1.0. This vulnerability affects unknown code of the file /admin/subject/controller.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/10/2026
This vulnerability resides within the SourceCodester Online Class Record System version 1.0, specifically in the administrative subject controller component located at /admin/subject/controller.php. The flaw represents a classic sql injection vulnerability that occurs when the application fails to properly sanitize or validate user input before incorporating it into database queries. The vulnerability is triggered when an attacker manipulates the ID argument parameter, which is then directly used in sql command construction without adequate input filtering or parameterization mechanisms.
The technical nature of this vulnerability aligns with CWE-89 which defines sql injection as the insertion of malicious sql queries into input data that is subsequently processed by a database. The attack vector is particularly concerning as it allows for remote exploitation without requiring authentication or physical access to the system. The fact that the exploit has been made public significantly increases the risk profile, as malicious actors can readily leverage this vulnerability to gain unauthorized access to the underlying database. This type of vulnerability enables attackers to execute arbitrary sql commands, potentially leading to data theft, data modification, or complete database compromise.
The operational impact of this vulnerability extends beyond simple data access violations. Remote attackers could leverage this sql injection flaw to extract sensitive information including user credentials, personal data, and institutional records stored within the class management system. The attack could result in unauthorized modification of class records, student information, or grading data, potentially disrupting educational operations. Additionally, the vulnerability may serve as a stepping stone for further attacks, allowing threat actors to escalate privileges and move laterally within the network infrastructure. The exposure of this vulnerability in a system designed for educational administration raises serious concerns about student privacy and institutional data security.
Mitigation strategies should prioritize immediate patching of the affected system to address the sql injection vulnerability in the controller.php file. Organizations should implement proper input validation and parameterized queries to prevent malicious sql code from being executed. The principle of least privilege should be enforced by limiting database access permissions for the web application. Network segmentation and intrusion detection systems should be deployed to monitor for suspicious sql injection attempts. Regular security assessments and code reviews should be conducted to identify similar vulnerabilities in other components of the system. According to ATT&CK framework, this vulnerability maps to T1190 (Exploit Public-Facing Application) and T1071.004 (Application Layer Protocol: DNS) as attackers may use this vulnerability to establish persistent access. The implementation of web application firewalls and regular security updates should be mandatory practices to prevent similar vulnerabilities from being exploited in the future.