SourceCodester Advanced School Management System CVE-2026-7545

The checkEmail endpoint in commonController.php must be exposed to network access without authentication (AV:N, PR:N confirmed in CVSS vector). The endpoint accepts user-supplied input in an HTTP parameter (checkEmail) and directly uses it in an SQL query without sanitization or parameterized queries. Default deployment configurations of SourceCodester Advanced School Management System 1.0 leave this endpoint accessible, as indicated by the public POC targeting it directly. No special configuration is explicitly required - the vulnerability exploits the default code behavior. Attack complexity is low (AC:L), requiring only standard HTTP request manipulation tools and no special network position or timing. Limitations: authentication may exist on other application functions, but the checkEmail endpoint itself accepts unauthenticated requests per the CVSS PR:N vector.

This vulnerability presents moderate real-world risk with notable exploitation likelihood. CVSS 4.0 score of 5.5 reflects low confidentiality, integrity, and availability impact in the calculated base vector, but the E:P (exploit proof-of-concept published) modifier elevates the environmental risk. The CVSS 4.0 vector shows AC:L (low attack complexity) and PR:N/UI:N (no authentication or user interaction), confirming network-based remote exploitation is straightforward. However, the VC/VI/VA scores (all L for low impact) suggest the scope of data compromise may be constrained to the database layer without lateral system impact. The public availability of exploit code substantially increases practical risk despite the moderate base score - defenders cannot rely on security obscurity. Notably absent: KEV (CISA Known Exploited Vulnerabilities) status is not confirmed, suggesting either recent disclosure (pre-KEV catalog lag) or limited active campaign exploitation despite POC availability. This discrepancy warrants verification - public POC does not always correlate with widespread active exploitation in production.

An attacker discovers a publicly accessible SourceCodester Advanced School Management System instance and crafts an HTTP request to the checkEmail endpoint with a malicious SQL payload embedded in the email parameter (e.g., checkEmail=admin' OR '1'='1). The application directly concatenates this input into a SELECT or UPDATE query without escaping, causing the SQL injection to execute. The attacker extracts sensitive data (student records, staff credentials, grades) or modifies database records to escalate privileges or alter academic records.