Description
A weakness has been identified in itsourcecode School Management System 1.0. The affected element is an unknown function of the file /course/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Published: 2026-01-28
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Patch
AI Analysis

Impact

The flaw resides in the unknown function of /course/index.php in itsourcecode School Management System 1.0, where manipulation of the ID argument can lead to an SQL injection that may be exploited remotely, allowing unauthorized data disclosure, tampering, or credential theft.

Affected Systems

Vendors impacted are itsourcecode with its School Management System version 1.0, and a related version 1.0 by Angel Judesuarez. All deployments of these products are vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog but public proof‑of‑concept exploits have been released, enabling attackers to leverage the remote SQL injection path if they can reach the vulnerable /course/index.php endpoint.

Generated by OpenCVE AI on April 18, 2026 at 01:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest official patch or update to a fixed version of the School Management System.
  • Sanitize all input parameters on /course/index.php and use parameterized queries to prevent SQL injection.
  • Restrict remote access to the vulnerable endpoint by firewall rules or IP whitelisting as a temporary mitigating measure.

Generated by OpenCVE AI on April 18, 2026 at 01:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 09:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:itsourcecode:school_management_system:*:*:*:*:*:*:*:*

Mon, 02 Feb 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Angeljudesuarez
Angeljudesuarez school Management System
CPEs cpe:2.3:a:angeljudesuarez:school_management_system:1.0:*:*:*:*:*:*:*
Vendors & Products Angeljudesuarez
Angeljudesuarez school Management System

Thu, 29 Jan 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 29 Jan 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Itsourcecode
Itsourcecode school Management System
Vendors & Products Itsourcecode
Itsourcecode school Management System

Wed, 28 Jan 2026 21:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode School Management System 1.0. The affected element is an unknown function of the file /course/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode School Management System index.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Angeljudesuarez School Management System
Itsourcecode School Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:01:53.581Z

Reserved: 2026-01-28T15:24:07.909Z

Link: CVE-2026-1545

cve-icon Vulnrichment

Updated: 2026-01-29T16:02:42.506Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-28T22:15:55.470

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-1545

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T01:45:33Z

Weaknesses