Description
A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/check_student.php. The manipulation of the argument student_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Published: 2026-09-07
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from improper handling of the student_id argument in the /society/check_student.php endpoint, allowing an attacker to inject arbitrary SQL statements. This can lead to unauthorized read, modification, or deletion of sensitive data stored in the system’s database, compromising confidentiality and integrity. The exploitation can occur over the network, making it a remote attack vector.

Affected Systems

itsourcecode Information System Society Membership System, version 1.0, in the check_student.php file located under /society/

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploit activity yet. However, the description states that a public exploit has been disclosed, so the likelihood of attack is non‑zero. Remote exploitation is possible through crafted HTTP requests that manipulate the student_id parameter, and no special privileges are required beyond a standard web client.

Generated by OpenCVE AI on September 7, 2026 at 04:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s patch or update to a fixed version of the Information System Society Membership System.
  • Validate and sanitize the student_id input to allow only numeric values before using it in SQL statements.
  • Use parameterized queries or prepared statements for all database interactions involving student_id.
  • Restrict the database account used by the application to the minimum privileges necessary for normal operation.

Generated by OpenCVE AI on September 7, 2026 at 04:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/check_student.php. The manipulation of the argument student_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Title itsourcecode Information System Society Membership System check_student.php sql injection
First Time appeared Itsourcecode
Itsourcecode information System Society Membership System
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:itsourcecode:information_system_society_membership_system:*:*:*:*:*:*:*:*
Vendors & Products Itsourcecode
Itsourcecode information System Society Membership System
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Itsourcecode Information System Society Membership System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-07T03:30:08.304Z

Reserved: 2026-09-06T12:30:44.217Z

Link: CVE-2026-86267

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-07T04:17:55.087

Modified: 2026-09-07T04:17:55.087

Link: CVE-2026-86267

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T08:24:22Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')