Description
A security vulnerability has been detected in itsourcecode Society Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/add_expenses.php. The manipulation of the argument detail leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Published: 2026-01-29
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection in add_expenses.php
Action: Control Mitigation
AI Analysis

Impact

The flaw resides in itsourcecode’s Society Management System 1.0 in the /admin/add_expenses.php script. An attacker can manipulate the ‘detail’ input parameter to inject arbitrary SQL statements. This remote SQL injection could allow unauthenticated read, modification, or deletion of database records, exposing sensitive information and compromising data integrity. The weakness is classified as CWE‑74 and CWE‑89.

Affected Systems

Itsourcecode Society Management System version 1.0 is the only affected release listed. No other product versions are currently identified as vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates a high risk severity, while the EPSS score of less than 1% suggests a low current exploitation probability; the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by sending crafted requests to the ‘detail’ parameter over HTTP or HTTPS. Successful exploitation would grant the attacker unauthenticated database access, potentially leading to data theft or manipulation.

Generated by OpenCVE AI on April 18, 2026 at 18:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the vendor’s website or support channels for an official patch or upgrade that addresses the SQL injection flaw in Society Management System 1.0.
  • If no patch is immediately available, reduce exposure by restricting external access to the /admin/add_expenses.php URL to authenticated users or a trusted IP range using firewall rules or VPN.
  • Modify the application code to enforce strict input validation or refactor the database access layer to use parameterized queries or prepared statements for the ‘detail’ field.
  • Deploy a web application firewall (WAF) with rules that detect and block SQL‑injection payloads targeting the ‘detail’ parameter.

Generated by OpenCVE AI on April 18, 2026 at 18:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Feb 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Angeljudesuarez
Angeljudesuarez society Management System
CPEs cpe:2.3:a:angeljudesuarez:society_management_system:1.0:*:*:*:*:*:*:*
Vendors & Products Angeljudesuarez
Angeljudesuarez society Management System

Fri, 30 Jan 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Itsourcecode
Itsourcecode society Management System
Vendors & Products Itsourcecode
Itsourcecode society Management System

Thu, 29 Jan 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 29 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in itsourcecode Society Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/add_expenses.php. The manipulation of the argument detail leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Title itsourcecode Society Management System add_expenses.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Angeljudesuarez Society Management System
Itsourcecode Society Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:05:00.713Z

Reserved: 2026-01-29T08:32:42.242Z

Link: CVE-2026-1594

cve-icon Vulnrichment

Updated: 2026-01-29T15:45:23.532Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-29T15:16:13.993

Modified: 2026-02-02T20:53:42.123

Link: CVE-2026-1594

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T18:45:05Z

Weaknesses