CVE-2026-86267

itsourcecode Information System Society Membership System check_student.php sql injection

View on CVE.org
Published Sep 7, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/check_student.php. The manipulation of the argument student_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Analysis

AI-generated

Technical impact

The vulnerability arises from improper handling of the student_id argument in the /society/check_student.php endpoint, allowing an attacker to inject arbitrary SQL statements. This can lead to unauthorized read, modification, or deletion of sensitive data stored in the system’s database, compromising confidentiality and integrity. The exploitation can occur over the network, making it a remote attack vector.

Affected Systems

itsourcecode Information System Society Membership System, version 1.0, in the check_student.php file located under /society/

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploit activity yet. However, the description states that a public exploit has been disclosed, so the likelihood of attack is non‑zero. Remote exploitation is possible through crafted HTTP requests that manipulate the student_id parameter, and no special privileges are required beyond a standard web client.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or update to a fixed version of the Information System Society Membership System.
  • Validate and sanitize the student_id input to allow only numeric values before using it in SQL statements.
  • Use parameterized queries or prepared statements for all database interactions involving student_id.
  • Restrict the database account used by the application to the minimum privileges necessary for normal operation.

Generated by OpenCVE AI on September 7, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/check_student.php. The manipulation of the argument student_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Title itsourcecode Information System Society Membership System check_student.php sql injection
First Time appeared Itsourcecode
Itsourcecode information System Society Membership System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:information_system_society_membership_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode information System Society Membership System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 8, 2026, 1:43 PM
Reserved
Sep 6, 2026, 12:30 PM

View source JSON

Updated
Sep 8, 2026, 1:43 PM

JSON

Status
Deferred
Published
Sep 7, 2026, 4:17 AM
Modified
Sep 28, 2026, 11:10 PM

View source JSON

No data.

Updated
Sep 7, 2026, 8:24 AM

JSON