The delete_judge.php component of itsourcecode's Electronic Judging System 1.0 accepts a judge_id parameter without proper validation, allowing attackers to inject arbitrary SQL code. This flaw stems from a lack of input sanitization (CWE‑74) and unsecured query construction (CWE‑89). The vulnerability can be triggered remotely through crafted HTTP requests, and publicly available exploits demonstrate that the attack can be executed without additional compromise of the host.

The vulnerability is confined to the 1.0 release of the Electronic Judging System from itsourcecode. It specifically targets the /admin/delete_judge.php script and does not affect other products or versions listed for this vendor.

With a CVSS score of 6.9, the flaw represents a moderate severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The description confirms that the attack vector is remote and that exploits are publicly available, indicating a non‑negligible risk of exploitation especially in environments lacking strict access controls for the administrative interface.