Description
A flaw has been found in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/settings/controller.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Published: 2026-02-06
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL injection allowing unauthorized data access or modification
Action: Immediate Patch
AI Analysis

Impact

A flaw was discovered in itsourcecode School Management System version 1.0, in an unknown area of the file /ramonsys/settings/controller.php. Manipulating the ID argument permits SQL injection, which can reveal or alter database contents and compromise data confidentiality and integrity due to the CWE-74 and CWE-89 weaknesses.

Affected Systems

The vulnerability affects itsourcecode School Management System, specifically the 1.0 release. Administrators of installations running this version should consider that the /controller.php component is compromised.

Risk and Exploitability

The CVSS score of 6.9 indicates a medium‑to‑high risk, while the EPSS score of less than 1% shows a low but non‑zero probability of exploitation. The vulnerability is not listed in KEV. Attackers can remotely trigger the injection by manipulating the ID parameter, as the exploit is publicly available. Given the data, the risk is moderate but the impact could be significant if a database compromise occurs.

Generated by OpenCVE AI on April 18, 2026 at 13:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest version of School Management System that contains a fix for this SQL injection vulnerability.
  • If an upgrade is not immediately possible, enforce strict input validation on the ID parameter to allow only numeric values or use parameterized queries to eliminate injection risk.
  • Restrict database access by applying the principle of least privilege, ensuring the web application only has read/write rights necessary for its functions.

Generated by OpenCVE AI on April 18, 2026 at 13:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 09:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:itsourcecode:school_management_system:*:*:*:*:*:*:*:*

Thu, 12 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 18:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:itsourcecode:school_management_system:1.0:*:*:*:*:*:*:*

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Itsourcecode
Itsourcecode school Management System
Vendors & Products Itsourcecode
Itsourcecode school Management System

Fri, 06 Feb 2026 12:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/settings/controller.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.
Title itsourcecode School Management System controller.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode School Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:24:48.698Z

Reserved: 2026-02-05T19:38:21.310Z

Link: CVE-2026-2018

cve-icon Vulnrichment

Updated: 2026-02-12T15:02:52.786Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-06T13:15:54.397

Modified: 2026-02-10T18:15:41.947

Link: CVE-2026-2018

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T13:45:45Z

Weaknesses