Description
A security flaw has been discovered in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/user/controller.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-02-08
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Database Access through Remote SQL Injection
Action: Apply Patch
AI Analysis

Impact

A flaw in School Management System 1.0 permits an attacker to supply a crafted ID argument in /ramonsys/user/controller.php, causing the application to execute arbitrary SQL statements. This injection vulnerability could allow the attacker to read, modify or delete database records, compromising the confidentiality, integrity, and availability of the system.

Affected Systems

itsourcecode School Management System version 1.0, particular to the controller.php file handling user functions. The vulnerability arises from improperly sanitized input in the ID parameter.

Risk and Exploitability

The CVSS score of 6.9 reflects moderate to high risk, while the EPSS score of less than 1% indicates low overall exploitation probability, yet a public exploit has been released. The attack can be executed remotely through standard HTTP requests, with no special prerequisites other than access to the affected endpoint. The system is not listed in CISA's KEV catalog, but the known public exploit suggests it remains a realistic threat for exposed installations.

Generated by OpenCVE AI on April 17, 2026 at 21:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and deploy the vendor‑supplied patch or upgraded version that resolves the SQL injection flaw
  • If a patch is not yet available, restrict external access to the /ramonsys/user/controller.php endpoint, allowing only authenticated and authorized users
  • Implement server‑side input validation by ensuring the ID parameter is a numeric value and use prepared statements or parameterized queries to eliminate injection opportunities
  • Deploy a web application firewall or intrusion detection system tuned to block common SQL injection patterns as an additional defense layer

Generated by OpenCVE AI on April 17, 2026 at 21:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 23 Feb 2026 10:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:itsourcecode:school_management_system:*:*:*:*:*:*:*:*

Tue, 10 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:itsourcecode:school_management_system:1.0:*:*:*:*:*:*:*

Mon, 09 Feb 2026 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 09 Feb 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Itsourcecode
Itsourcecode school Management System
Vendors & Products Itsourcecode
Itsourcecode school Management System

Sun, 08 Feb 2026 22:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/user/controller.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Title itsourcecode School Management System controller.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode School Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T09:50:35.152Z

Reserved: 2026-02-07T17:22:04.971Z

Link: CVE-2026-2190

cve-icon Vulnrichment

Updated: 2026-02-09T20:58:10.849Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-08T23:15:48.527

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-2190

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T21:45:28Z

Weaknesses