CVE-2026-15672

itsourcecode Electronic Judging System add_judges.php sql injection

View on CVE.org
Published Jul 14, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/add_judges.php. This manipulation of the argument fname causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Analysis

AI-generated

Technical impact

A code path in the add_judges.php script of itsourcecode Electronic Judging System 1.0 allows an attacker to supply arbitrary SQL statements via the fname parameter. This can enable the execution of unintended queries against the backend database, compromising confidentiality and integrity by allowing unauthorized data retrieval, modification, or deletion. The weakness is classified as CWE-74 and CWE-89.

Affected Systems

Itsourcecode Electronic Judging System version 1.0 is exposed to the flaw. No further version granularity is provided in the current report.

Risk and Exploitability

The CVSS score of 5.3 classifies the issue as moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, the condition that the attack can be initiated remotely and the fact that the exploit has been publicly disclosed mean that an attacker could readily craft a malicious request to the fname argument to cause arbitrary SQL execution if the system remains unpatched.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the vendor’s official website or support resources for an available patch or fix that addresses the SQL injection in add_judges.php.
  • If a patch is not yet released, restrict access to the add_judges.php endpoint by enforcing authentication and role‑based access control so only authorized administrative users can reach the script.
  • Modify the application logic to employ parameterized queries or proper input validation for the fname parameter, thereby eliminating the injection vector.

Generated by OpenCVE AI on July 31, 2026 at 10:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/add_judges.php. This manipulation of the argument fname causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Title itsourcecode Electronic Judging System add_judges.php sql injection
First Time appeared Itsourcecode
Itsourcecode electronic Judging System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:electronic_judging_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode electronic Judging System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 15, 2026, 2:36 PM
Reserved
Jul 13, 2026, 9:13 PM

View source JSON

Updated
Jul 15, 2026, 2:36 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 6:17 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 11:00 AM

JSON