CVE-2026-4573

The vulnerability is a time-based blind SQL injection in SourceCodester Simple E-learning System version 1.0. The flaw resides in the /includes/form_handlers/delete_post.php file, where the post_id parameter from GET requests is directly concatenated into SQL queries without proper sanitization. This allows an attacker to inject malicious SQL payloads, particularly SLEEP() statements, to infer data by observing response delays.

Exploitation requires authentication to the application. An attacker must have valid credentials (e.g., a teacher account) and access to the delete post functionality. The parameter post_id is passed via GET request, and tools like sqlmap can automate the extraction of data. The provided proof-of-concept demonstrates a time-based blind injection using a payload that triggers a 5-second sleep when the condition is true.

Successful exploitation enables an authenticated attacker to retrieve arbitrary data from the database, including user credentials, session tokens, or other sensitive information. The attack is remote and does not require any special privileges beyond basic user access.

As of the advisory, no patch has been released. Users should limit access to the application, apply input validation, or use parameterized queries to mitigate the risk. The exploit has been publicly disclosed [1].