Car Driving School CVE-2026-102913

Exploitation targets the /classes/Master.php endpoint with the f=save_enrollment action handler in SourceCodester Car Driving School Management System 1.0; the attacker manipulates a request parameter processed by this enrollment-save routine to inject SQL. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, and the attack is remote against a default-reachable installation. The primary limiting factor is deployment scale: this is a rarely-installed open-source PHP application, and exploitation requires only that an instance be network-accessible.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, unauthenticated, low-complexity SQL injection, which normally maps to serious risk; however the vulnerable-system impacts are all Low (VC:L/VI:L/VA:L) with no subsequent-system impact, producing a moderate 6.9 score rather than a critical one - consistent with a typical VulDB-scored injection where full DB compromise was not demonstrated. The E:P (Proof-of-Concept) exploit maturity aligns with the confirmed public exploit on GitHub. There is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or automated exploitation - this is publicly available exploit code, not confirmed in-the-wild abuse. Realistically this is a low-priority issue driven by the niche, low-footprint product rather than the flaw class itself; a well-known SourceCodester-family SQLi with a public PoC is trivially exploitable but the affected software is rarely deployed in production enterprises. Note the CVSS impact metrics (all Low) likely understate real SQLi potential (SQL injection commonly yields full confidentiality/integrity impact), so defenders should treat the L ratings as conservative rather than definitive.

A remote, unauthenticated attacker sends a crafted HTTP request to /classes/Master.php?f=save_enrollment with malicious SQL in a manipulated parameter, injecting into the backend query. A public proof-of-concept exists (GitHub issue referenced by VulDB), so exploitation requires no original research and can be replicated directly. Given AV:N/AC:L/PR:N, the attacker needs only network reachability to the application.