CVE-2026-2089 is a high severity SQL injection flaw (CVSS 7.3) in SourceCodester Online Class Record System 1.0. The ID parameter of /admin/subject/controller.php reaches a database query unsafely. The record lists no fixed version, so remove the app from public reach and fix the query yourself.
What's affected
The record names SourceCodester Online Class Record System 1.0. The weakness is classed as CWE-89 (SQL injection) and CWE-74 (injection). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L means network reachable, low complexity, no login, no user interaction.
No fixed version is listed. I could not find a vendor advisory or patch to confirm one, so treat every copy of this release as affected until you hear otherwise. The record says a working exploit has been publicly disclosed. It does not say the flaw is exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Start by finding out whether you run it at all. These apps are often copied onto a server for a class project or an internal pilot and then forgotten.
find /var/www -type f -path "*/admin/subject/controller.php" 2>/dev/null
If that returns a hit, open the file and look at how the ID value is used. Concatenating it into an SQL string is the problem. Then check your web server logs for requests to that file from addresses you do not recognize, and look for unusually long or odd looking values in the ID parameter.
For any dependency manifest the project does ship, the free in-browser scan shows known issues in its packages.
What to do now
- Take the app off the public internet, or put it behind a VPN or an IP allowlist, today.
- Replace string building in /admin/subject/controller.php with a prepared statement and bound parameters. The same fix belongs in every other file that builds queries from request input.
- Run the database account with the least privilege the app needs. It should not own the schema, and it should not be able to read tables the app never touches.
- Watch the vendor page and the CVE-2026-2089 entry for a patched release, and retire the app if none appears.
Why it matters
This is the second record for the same application in this batch, and it points at a different file. When one app has several injection points, patching a single line leaves the rest. Review every query in the code base, not just the file named here.
SQL injection happens when request text is treated as part of a query instead of as a plain value. The fix is to send the query and the values separately.
$stmt = $pdo->prepare('SELECT * FROM subjects WHERE id = ?');
$stmt->execute([$id]);
Quick check
Is there a patch for CVE-2026-2089?
The record lists none, and I could not confirm a vendor fix. Check the vendor site and the NVD entry before assuming one exists.
Is this the same bug as CVE-2026-2087?
No. It is a separate record that affects a different file of the same product. Fixing one does not fix the other.
Sources
- The public issue linked from the record (https://github.com/xiaoccm07/cve/issues/2) did not load when this post was reviewed, so the statements above rest on the NVD record.
- NVD record for CVE-2026-2089
Last reviewed: 19 October 2026.
