Description
A weakness has been identified in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/course/controller.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-01-28
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote SQL Injection
Action: Apply Patch
AI Analysis

Impact

An unknown component of itsourcecode School Management System 1.0 contains a vulnerability in the controller.php file that allows an attacker to manipulate the ID argument and inject arbitrary SQL statements. The flaw is classified as CWE-74 and CWE-89 and enables the attacker to execute the injected SQL remotely, potentially reading, modifying or deleting sensitive data in the database, and escalating privileges if the database user has high permissions.

Affected Systems

The affected system is itsourcecode School Management System version 1.0. No other versions were explicitly listed as impacted. The vulnerability resides in the /ramonsys/course/controller.php file of this product.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the public availability of an exploit means that attackers could target the system if it is not patched. Attackers would need to send a crafted request to the application’s ID parameter from a remote location to trigger the injection.

Generated by OpenCVE AI on April 18, 2026 at 14:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest security patch or update the School Management System to a version that includes remediation of the SQL injection vulnerability, if released by itsourcecode.
  • Configure the application to use parameterized queries or prepared statements for database interactions involving the ID argument.
  • Restrict the database user account used by the application to the minimum permissions necessary (e.g., select only), to limit potential data exposure in case injection occurs.
  • Deploy a web application firewall or intrusion detection system tuned to detect suspicious SQL injection patterns, and monitor traffic for the /ramonsys/course/controller.php endpoint.

Generated by OpenCVE AI on April 18, 2026 at 14:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 09:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:itsourcecode:school_management_system:*:*:*:*:*:*:*:*

Mon, 02 Feb 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Angeljudesuarez
Angeljudesuarez school Management System
CPEs cpe:2.3:a:angeljudesuarez:school_management_system:1.0:*:*:*:*:*:*:*
Vendors & Products Angeljudesuarez
Angeljudesuarez school Management System

Thu, 29 Jan 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 29 Jan 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Itsourcecode
Itsourcecode school Management System
Vendors & Products Itsourcecode
Itsourcecode school Management System

Wed, 28 Jan 2026 23:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/course/controller.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode School Management System controller.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Angeljudesuarez School Management System
Itsourcecode School Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:03:14.332Z

Reserved: 2026-01-28T16:56:52.080Z

Link: CVE-2026-1551

cve-icon Vulnrichment

Updated: 2026-01-29T15:58:03.960Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-29T00:16:08.450

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-1551

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T14:45:03Z

Weaknesses