SQL Injection in School Fee Payment Report Module

A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/pay_report.php. Performing a manipulation of the argument period results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-90516 is a remote SQL injection vulnerability in SourceCodester School Registration and Fee System version 1.0, specifically in the pay_report.php file's period parameter. With a CVSS score of 7.3, this high-severity flaw allows unauthenticated attackers to manipulate database queries by injecting malicious SQL code through a web-accessible endpoint. Educational institutions using this system are directly at risk, as attackers could extract sensitive student records, financial data, and staff information stored in the backend database. The public availability of exploit code significantly increases the likelihood of active attacks against unpatched installations.

Casky's 323 matched skills leverage Claude AI with extended reasoning to correlate this vulnerability across the MITRE ATT&CK framework, specifically mapping to TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would observe detection patterns identifying CWE-74 (Improper Neutralization of Special Elements in Output) and CWE-89 (SQL Injection) signatures in parameter manipulation attempts targeting the pay_report.php endpoint. The platform's skill set would flag suspicious query patterns, database error messages indicating injection attempts, and unusual SQL statement structures in access logs. Security teams would see enriched findings showing the attack chain—from initial reconnaissance of the vulnerable endpoint through exploitation for data exfiltration—enabling them to prioritize remediation and implement input validation controls before attackers gain database-level access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-90516.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-90516

Casky has 323 skills that investigate the attack patterns behind CVE-2026-90516. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn