Description
A weakness has been identified in itsourcecode Document Management System 1.0. This impacts an unknown function of the file /deluser.php. Executing a manipulation of the argument user2del can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
Published: 2026-02-24
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection leading to unauthorized data access and modification
Action: Immediate Patch
AI Analysis

Impact

A vulnerability exists in the Document Management System's deluser.php file where user-supplied input "user2del" is not properly sanitized, allowing attackers to inject arbitrary SQL commands. The injection can alter the database, potentially exposing or deleting sensitive user data. The weakness is classified under CWE-74 (SQL code in a dynamic data element) and CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Affected Systems

The vulnerability is found in itsourcecode Document Management System version 1.0, as reported by the CNA. No other versions are currently identified as vulnerable.

Risk and Exploitability

The CVSS v3.1 score of 6.9 indicates moderate impact on confidentiality, integrity, and availability. The EPSS score of less than 1% implies a low overall exploitation probability, but the presence of a publicly available exploit increases the likelihood of targeted attacks. The vulnerability is not yet listed in CISA’s KEV catalog, yet remote exploitation remains feasible because the attack vector is remote and the application exposes the vulnerable endpoint over the network.

Generated by OpenCVE AI on April 18, 2026 at 10:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch for deluser.php or upgrade to a version that addresses the SQL injection flaw.
  • If a patch is unavailable, modify deluser.php to use parameterized queries or escape the "user2del" input so that injected SQL cannot be executed.
  • Implement a Web Application Firewall rule to detect and block typical SQL injection payloads targeting the deluser.php endpoint.

Generated by OpenCVE AI on April 18, 2026 at 10:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 24 Feb 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Admerc
Admerc document Management System
CPEs cpe:2.3:a:admerc:document_management_system:1.0:*:*:*:*:*:*:*
Vendors & Products Admerc
Admerc document Management System

Tue, 24 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 24 Feb 2026 10:00:00 +0000

Type Values Removed Values Added
First Time appeared Itsourcecode
Itsourcecode document Management System
Vendors & Products Itsourcecode
Itsourcecode document Management System

Tue, 24 Feb 2026 04:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in itsourcecode Document Management System 1.0. This impacts an unknown function of the file /deluser.php. Executing a manipulation of the argument user2del can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
Title itsourcecode Document Management System deluser.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Admerc Document Management System
Itsourcecode Document Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-24T18:34:43.481Z

Reserved: 2026-02-23T18:56:02.164Z

Link: CVE-2026-3068

cve-icon Vulnrichment

Updated: 2026-02-24T18:34:38.220Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-24T04:15:59.427

Modified: 2026-02-24T21:04:16.370

Link: CVE-2026-3068

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T11:00:05Z

Weaknesses