SQL Injection in School Registration System Category Parameter

A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_class.php. The manipulation of the argument Category leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-90526 represents a critical SQL injection vulnerability in SourceCodester School Registration and Fee System version 1.0, specifically within the /bilal/save_class.php file's Category parameter. This vulnerability allows remote attackers to manipulate database queries without authentication, potentially exposing or modifying sensitive student and fee records. Educational institutions using this system—particularly schools managing student registration and financial data—face immediate risk of data breach, unauthorized access, and system compromise. With CVSS 7.3 severity and public disclosure, this vulnerability has become an attractive target for opportunistic threat actors seeking to exploit weakly-defended education sector infrastructure.

Casky's 323 mapped skills enable detection of this attack pattern by correlating CWE-74 (Improper Neutralization of Special Elements) and CWE-89 (SQL Injection) indicators against MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). When Claude AI analyzes incoming requests to /bilal/save_class.php, extended reasoning identifies malicious SQL syntax in the Category parameter—such as SQL keywords, boolean-based payloads, or union-based query structures. Practitioners using Casky would observe findings showing anomalous HTTP POST requests with suspicious character encoding, SQL metacharacters, and database error responses indicating query manipulation. These behavioral patterns reveal exploitation attempts at the reconnaissance and initial access phases, allowing security teams to block attacks before database compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-90526.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-90526

Casky has 323 skills that investigate the attack patterns behind CVE-2026-90526. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn