CVE-2026-1593: Society Management System SQL Injection in edit_expenses_query.php
CVE-2026-1593 is an SQL injection weakness in the administrative file /admin/edit_expenses_query.php of the itsourcecode Society Management System 1.0, triggered through the detail argument. NVD scored it 9.8 (critical) under CVSS 3.1, while the CNA VulDB scored it 7.3 under CVSS 3.1. The record states that a public exploit exists, but CISA KEV does not list this CVE and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-1593 describes an SQL injection issue in the administrative script /admin/edit_expenses_query.php of the itsourcecode Society Management System 1.0. According to the record, manipulating the detail argument can lead to SQL injection, and the attack may be launched remotely. The record was published on 2026-01-29 and has status Analyzed.
Impact
- SQL injection can allow an attacker to interfere with database queries. The actual data exposure or modification depends on the application and database configuration, which the record does not describe.
- NVD assigns CVSS 3.1 base score 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates high impact on confidentiality, integrity and availability if the vector is accurate.
- The record classifies the weakness as CWE-74 (Injection).
Affected products and versions
- The affected product field lists Angeljudesuarez Society Management System, version 1.0, while the description refers to the itsourcecode Society Management System 1.0. This naming difference should be verified against the vendor pages.
- No other affected versions are listed in the record.
Exploitation status
- The record states that an exploit has been made available to the public, and the GitHub issue cited in the record carries an Exploit tag.
- CISA KEV does not list this CVE, so the record does not confirm active exploitation. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- The record references a mitigation discussion in a third-party GitHub issue. The content of that issue was not available for this analysis, and no fixed version is listed.
- Until an official fix is confirmed, restrict access to the administrative area, require strong authentication, and limit network exposure of the application.
- Review the affected script for input validation and use of parameterized queries, and consider isolating or replacing the application if no vendor fix is available.
Detection guidance
- Review web server logs for requests to /admin/edit_expenses_query.php that contain unusual or malformed values in the detail parameter.
- Monitor database error messages and unexpected administrative activity associated with this application.
Limitations of the available information
- The record does not name a vendor fix, patch or fixed version.
- The product name differs between the affected product field and the title and description.
- EPSS and SSVC data are not available. VulDB also provided CVSS 4.0 (score 5.5) and CVSS 2.0 (score 7.5) entries, which differ from the NVD score.
Frequently asked questions
Is CVE-2026-1593 being actively exploited?
The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. The record does state that a public exploit is available.
Which product and version are affected?
The record lists Angeljudesuarez Society Management System version 1.0, while the title refers to the itsourcecode Society Management System 1.0. Verify the product identity with the vendor before relying on either name.
Is there a fixed version?
No fixed version is named in the record. A mitigation reference exists in a third-party GitHub issue, but its content was not available for this analysis.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.