CVE-2020-36084

CVE-2020-36084 is a SQL injection vulnerability (CWE-89) in SourceCodester Responsive E-Learning System 1.0. The flaw resides in the /elearning/delete_teacher_students.php endpoint, where the 'id' parameter fails to properly sanitize user input, allowing remote attackers to inject arbitrary SQL queries.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no privileges, no user interaction, and unchanged impact scope. Remote unauthenticated attackers can execute malicious SQL queries to achieve high impacts on confidentiality, integrity, and availability, such as extracting sensitive data, modifying records, or disrupting database operations.

A proof-of-concept exploit is publicly available on Exploit-DB at https://www.exploit-db.com/exploits/49357. No vendor advisories or patch details are referenced in the available information.