CVE-2026-1589: itsourcecode School Management System 1.0 SQL Injection via txtsearch in /ramonsys/inquiry/index.php
A SQL injection weakness was reported in the txtsearch argument of /ramonsys/inquiry/index.php in itsourcecode School Management System 1.0. The NVD base score is 9.8 (CVSS 3.1) and the record states the attack can be launched remotely and that a public exploit exists. No confirmed exploitation in the wild appears in the sources consulted, and no fixed version is identified in the record.
Overview
The NVD and CVE records describe an SQL injection weakness in the txtsearch argument of /ramonsys/inquiry/index.php in itsourcecode School Management System 1.0. The record indicates the issue can be triggered remotely and that an exploit has been publicly disclosed.
Impact
SQL injection can allow an attacker to read, modify or delete database content, depending on how the application and database are configured. The NVD base score is 9.8 (CVSS 3.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which points to network reachability, no required privileges and no user interaction. The specific consequences in a given deployment are an inference and have not been verified.
Affected products and versions
- The description names itsourcecode School Management System, version 1.0.
- The affected-products field names Angeljudesuarez School Management System, version 1.0. The record does not explain how these two names relate.
- Other scores in the record come from VulDB as the CNA: 7.3 (3.1), 5.5 (4.0) and 7.5 (2.0).
Exploitation status
This CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation in the wild appears in the sources consulted. The record does state that the exploit has been publicly disclosed and may be used, which raises the risk of opportunistic abuse.
Remediation and mitigation
- The record does not identify a fixed version. The absence of fix data does not mean no fix exists, so confirm with the vendor or software distributor.
- If patching cannot happen promptly, restrict access to the affected search functionality, limit it to trusted networks and users, and place it behind access controls.
- Review the search handler code and move to parameterized queries with strict input validation. Make sure the database account used by the application has only the privileges it needs.
- The record contains a third-party link tagged as exploit-related. It was not used as a remediation source and should be handled with caution.
Detection guidance
- Review web server and application logs for unusual or malformed requests to the inquiry search path, especially those with unexpected characters in the search parameter.
- Watch for database errors referencing SQL syntax that originate from the web application.
- Consider alerts on unusual request volumes to this path from unfamiliar sources.
Limitations of the available information
The record provides no confirmed fixed version, no vendor advisory, no EPSS score and no SSVC data. The product name differs between the description and the affected-products field. The CWE is listed as CWE-74 (Injection), while the description specifically refers to SQL injection. Scores come from different providers and CVSS versions and should be compared with care.
Frequently asked questions
Is this SQL injection being actively exploited?
The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit has been disclosed.
Which versions are affected?
The record names version 1.0 of the itsourcecode School Management System, and the affected-products field lists version 1.0 under a differently named product. No other versions are identified.
Is there a fixed version?
The record does not identify a fixed version. Confirm with the vendor or distributor, and apply access restrictions and secure coding fixes in the meantime.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.