Description
A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/search_student.php. The manipulation of the argument Search leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Published: 2026-03-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Apply Patch
AI Analysis

Impact

The vulnerability in itsourcecode College Management System 1.0 allows an attacker to inject arbitrary SQL code via the Search parameter in the /admin/search_student.php endpoint. This flaw is classified as a classic SQL injection (CWE‑89) with additional unvalidated input handling (CWE‑74). An attacker can use the injection to read, modify, or delete data from the database, potentially exposing sensitive student information or disrupting the system's integrity.

Affected Systems

Affected is the College Management System from vendor itsourcecode, version 1.0. No additional sub‑versions are specified; all instances of the 1.0 release that include the /admin/search_student.php file are vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, and the vulnerability can be exploited remotely without any local access. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is publicly disclosed, attackers are likely to target any exposed instance of the vulnerable endpoint using simple injection payloads. The risk to confidentiality and integrity is significant, though availability impact is not explicitly reported.

Generated by OpenCVE AI on March 20, 2026 at 15:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the itsourcecode website for a vendor patch or newer release of College Management System and apply it immediately if available.
  • If no patch is published, replace the vulnerable Search parameter handling with parameterized queries or prepared statements to eliminate direct SQL concatenation.
  • Restrict remote access to the /admin/search_student.php endpoint (for example, by limiting to trusted IP ranges) to reduce the attack surface until a code fix is deployed.

Generated by OpenCVE AI on March 20, 2026 at 15:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 20 Mar 2026 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 20 Mar 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Itsourcecode
Itsourcecode college Management System
Vendors & Products Itsourcecode
Itsourcecode college Management System

Fri, 20 Mar 2026 14:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/search_student.php. The manipulation of the argument Search leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Title itsourcecode College Management System search_student.php sql injection
Weaknesses CWE-74
CWE-89
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode College Management System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-20T21:30:14.666Z

Reserved: 2026-03-20T08:08:02.659Z

Link: CVE-2026-4485

cve-icon Vulnrichment

Updated: 2026-03-20T21:30:10.663Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-20T14:16:16.687

Modified: 2026-03-24T15:54:09.400

Link: CVE-2026-4485

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-25T14:29:25Z

Weaknesses