A SQL injection flaw has been found in itsourcecode’s Parameter Handler component, specifically through manipulation of the subject_code argument in the /admin/subjects.php page. An attacker who can supply a crafted subject_code value can cause arbitrary SQL statements to be executed on the underlying database. This vulnerability would allow an attacker to read, modify or delete data, thereby compromising confidentiality, integrity and availability of the application’s data.

The issue targets the itsourcecode sanitize or validate this input product, version 1.0. The affected component processes a file located at /admin/subjects.php. Versions of the product other than 1.0 have not been confirmed as affected, but the vulnerability may exist in any build that contains the same Parameter Handler implementation.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is exploitable remotely over the internet. No EPSS score is available and it is not listed in CISA’s KEV catalog, suggesting that it is not currently a widely detected exploit. Nevertheless, the public disclosure and the fact that the attack vector is remote make it a notable risk for systems lacking a patch or mitigations.