A vulnerability was identified in itsourcecode Electronic Judging System 1.0, specifically affecting the file /admin/edit_judge.php. By manipulating the judge_id parameter, an attacker can execute arbitrary SQL statements, allowing for read, write or delete operations on the database. This injection can compromise the confidentiality, integrity and availability of the system’s data, potentially exposing sensitive judge information and altering the outcome of submissions.

The affected product is itsourcecode Electronic Judging System version 1.0, running on the /admin/edit_judge.php endpoint. No other versions or modules were enumerated as vulnerable in the available data.

The CVSS score of 6.9 indicates a moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, as the input can be supplied through HTTP requests to the affected endpoint. Public disclosures exist, so an attacker who knows the flaw can exploit it without additional privileges to compromise the underlying database.