CVE-2026-5537
SQL Injection in halex CourseSEL HTTP GET Parameter Handler
Publication date: 2026-04-05
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| halex | coursel | to 1.1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5537 is a SQL Injection vulnerability in the CourseSEL Online Course Selection System (version 1.1.0 and earlier) developed by halex. It occurs in the check_sel method of the IndexController.class.php file, where the HTTP GET parameter 'seid' is improperly handled and directly concatenated into an SQL query without proper sanitization or parameterization.
This improper handling allows an attacker with low privileges (such as a logged-in student) to craft malicious input that manipulates the SQL query, leading to unauthorized database access and control.
The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and can be exploited remotely by sending specially crafted HTTP GET requests with a valid session.
How can this vulnerability impact me? :
Exploiting this vulnerability allows an attacker to bypass authorization controls and escalate privileges within the CourseSEL system.
- Extract sensitive database schema information.
- Dump administrative credentials from the cs_user table.
- Gain full control over the application.
The attack requires only a low-privilege authenticated session and can be automated using tools like sqlmap, making it a significant risk for data compromise and system integrity.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the SQL Injection flaw in the HTTP GET parameter 'seid' of the check_sel function. An attacker or tester can send specially crafted HTTP GET requests with malicious payloads to check for SQL Injection.
A practical way to detect this vulnerability is by using the sqlmap tool with a request file containing a valid HTTP request to the vulnerable endpoint. The following command can be used to automate detection:
- sqlmap -r req.txt -p seid --technique=E --batch --current-db
This command uses error-based SQL Injection techniques to identify the injection point on the 'seid' parameter, bypass frontend authentication, and retrieve the backend database name.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The SQL Injection vulnerability in halex CourseSEL allows attackers to bypass authorization controls, extract sensitive database information, and potentially gain full control over the application. This can lead to unauthorized access to personal and sensitive data stored within the system.
Such unauthorized data access and potential data breaches can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information against unauthorized access and disclosure.
Therefore, exploitation of this vulnerability could result in violations of data protection requirements, leading to legal and regulatory consequences for organizations using the affected software.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the SQL Injection vulnerability in halex CourseSEL up to version 1.1.0, immediate steps include sanitizing and parameterizing the input for the 'seid' HTTP GET parameter in the check_sel function to prevent direct concatenation into SQL queries.
Restrict access to the vulnerable endpoint by enforcing stricter authentication and authorization controls, ensuring that only properly privileged users can access it.
Monitor and analyze web server logs for suspicious requests targeting the 'seid' parameter to detect potential exploitation attempts.
If possible, temporarily disable or restrict the vulnerable functionality until a patch or update is available from the vendor.
Use web application firewalls (WAFs) to block malicious payloads targeting SQL Injection vectors.