CVE Intelligence
Analysis AI-assisted

CVE-2026-0544: itsourcecode School Management System index.php SQL injection

A SQL injection flaw in the ID argument of /student/index.php in itsourcecode School Management System 1.0 can be triggered remotely. The record reports that an exploit has been released publicly and lists an NVD base score of 9.8. No confirmed exploitation in the wild appears in the sources consulted, and no fixed version is listed.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes an SQL injection flaw in the file /student/index.php of itsourcecode School Management System 1.0. According to the description, manipulation of the ID argument results in SQL injection, and the attack can be launched remotely. The weakness is classified as CWE-89 (SQL Injection).

Impact

  • Confirmed by the record: the NVD base score is 9.8 and the severity is critical.
  • Inference: a successful SQL injection could allow an attacker to read, modify or delete database content, depending on database permissions and application configuration.

Affected products and versions

  • Product: itsourcecode School Management System.
  • Version listed in the record: 1.0.
  • The record does not describe any other affected versions. Verify other releases against vendor information.

Exploitation status

The description states that the exploit has been released to the public and may be used for attacks. The CISA KEV catalog does not list this CVE in the record, so no confirmed exploitation in the wild appears in the sources consulted. The SSVC data in the record shows exploitation as none and automatable as yes.

Remediation and mitigation

  • No fixed version is listed in the record. Treat remediation status as unknown and check with the vendor at itsourcecode.com.
  • Restrict access to the affected application where possible, and disable or remove instances that are not needed.
  • Use parameterized queries and strict server-side validation for the ID parameter in the affected code path.
  • Run the web application with database accounts that have least privilege.

Detection guidance

  • Review web server and application logs for requests to /student/index.php that contain unusual or non-numeric values in the ID parameter.
  • Monitor application database errors and unexpected query behavior.
  • If a web application firewall is in use, watch for SQL-related anomalies and tune rules to limit false positives.

Limitations of the available information

  • The record does not identify the exact vulnerable code, the authentication requirements beyond remote access, or the affected file sections beyond /student/index.php.
  • No fixed version, vendor advisory or patch is listed.
  • Further details are available in the VulDB entry and the NVD record.

Frequently asked questions

Is this vulnerability being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The description does state that a public exploit has been released.

Which product and file are affected?

The record points to itsourcecode School Management System 1.0 and the file /student/index.php, where the ID argument is involved.

Is a fix available?

The record lists no fixed version. Check the vendor at itsourcecode.com and treat remediation status as unknown until confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.