CVE-2026-5537: SQL Injection in halex CourseSEL
A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function check_sel of the file Apps/Index/Controller/IndexController.class.php of the component HTTP GET Parameter Handler. The manipulation of the argument seid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AI Analysis
Technical Summary
This vulnerability affects halex CourseSEL versions 1.0 and 1.1.0. It arises from improper sanitization of the 'seid' HTTP GET parameter in the check_sel function of the IndexController.class.php file, enabling SQL injection attacks. The vulnerability can be exploited remotely without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor was notified but has not issued any fix or advisory. No known exploits are currently reported in the wild.
Potential Impact
Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the 'seid' parameter. This may lead to unauthorized data access or modification. However, the CVSS vector indicates limited confidentiality, integrity, and availability impacts, and no privilege escalation or user interaction is required. The lack of vendor response and patch means the vulnerability remains unmitigated in affected versions.
Mitigation Recommendations
No official patch or remediation is currently available from the vendor. Users of halex CourseSEL versions 1.0 and 1.1.0 should consider implementing application-level input validation or web application firewall (WAF) rules to block or sanitize the 'seid' parameter as a temporary mitigation. Monitoring for suspicious activity related to this parameter is advisable. Check the vendor advisory regularly for updates or official fixes.
CVE-2026-5537: SQL Injection in halex CourseSEL
Description
A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function check_sel of the file Apps/Index/Controller/IndexController.class.php of the component HTTP GET Parameter Handler. The manipulation of the argument seid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects halex CourseSEL versions 1.0 and 1.1.0. It arises from improper sanitization of the 'seid' HTTP GET parameter in the check_sel function of the IndexController.class.php file, enabling SQL injection attacks. The vulnerability can be exploited remotely without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor was notified but has not issued any fix or advisory. No known exploits are currently reported in the wild.
Potential Impact
Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database via the 'seid' parameter. This may lead to unauthorized data access or modification. However, the CVSS vector indicates limited confidentiality, integrity, and availability impacts, and no privilege escalation or user interaction is required. The lack of vendor response and patch means the vulnerability remains unmitigated in affected versions.
Mitigation Recommendations
No official patch or remediation is currently available from the vendor. Users of halex CourseSEL versions 1.0 and 1.1.0 should consider implementing application-level input validation or web application firewall (WAF) rules to block or sanitize the 'seid' parameter as a temporary mitigation. Monitoring for suspicious activity related to this parameter is advisable. Check the vendor advisory regularly for updates or official fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-04-04T06:42:15.923Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d1dada0a160ebd92844aca
Added to database: 4/5/2026, 3:45:30 AM
Last enriched: 4/5/2026, 4:00:37 AM
Last updated: 4/5/2026, 11:05:06 AM
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.