CVE-2026-1595: itsourcecode Society Management System SQL Injection via student_id
CVE-2026-1595 is an SQL injection flaw in the student_id argument of /admin/edit_student_query.php in itsourcecode Society Management System 1.0, which the record says can be exploited remotely. NVD lists a CVSS 3.1 base score of 9.8 (Critical), while the CNA VulDB scores range from 5.5 to 7.5 depending on CVSS version. The record states a public exploit exists, but CISA KEV does not list this CVE and no fixed version is identified.
Overview
CVE-2026-1595 affects itsourcecode Society Management System 1.0. According to the record, the flaw is in an unspecified part of the file /admin/edit_student_query.php, where the student_id argument is not handled safely and allows SQL injection. The record classifies the weakness as CWE-74 (Injection). Publication date in the record is 2026-01-29.
Impact
SQL injection can allow an attacker who reaches the vulnerable function to influence database queries. The NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates network access, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. The exact data exposed or modified depends on the application's database configuration, which is not described in the record.
Affected products and versions
- Product named in the description: itsourcecode Society Management System, version 1.0.
- The structured affected-product field names Angeljudesuarez Society Management System, version 1.0. This naming difference is not resolved by the record and should be checked against the vendor and the VulDB entry.
- No other affected versions are listed in the record.
Exploitation status
The record states that the exploit is public and may be used. The CISA KEV catalog does not list CVE-2026-1595, so the record does not confirm active exploitation or exploitation in the wild. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
The record contains one mitigation reference, a GitHub issue in the yyzq-wsx repository, but it does not identify a fixed version of the product. Until the vendor or maintainer confirms a fix, administrators should restrict access to the /admin area to trusted networks, apply additional authentication controls, and consider removing or disabling the affected administrative page if it is not required. Input validation and the use of parameterized queries are the standard long-term remedies for SQL injection and should be verified in the application code.
Detection guidance
- Review web server and application logs for requests to /admin/edit_student_query.php with unusual or malformed student_id values.
- Look for database error messages returned to clients, unexpected query timing, or abnormal volumes of requests to administrative pages.
- Monitor for unexpected changes to student or administrative records.
- Web application firewall rules may help reduce exposure but do not replace a code fix.
Limitations of the available information
The record does not specify the exact vulnerable code, the parameter handling in detail, or a fixed version. The vendor naming differs between the description and the affected-product field. The EPSS score and SSVC data are not available. The CVSS scores differ by source and version, and the CNA scores are lower than the NVD score.
Frequently asked questions
Is CVE-2026-1595 being actively exploited?
The record says a public exploit exists, but CVE-2026-1595 is not listed in CISA KEV and the sources consulted do not confirm exploitation in the wild.
Is there a fixed version?
The record does not identify a fixed version. It only references a mitigation in a GitHub issue, so administrators should check with the vendor or maintainer.
What is the severity?
NVD assigns a CVSS 3.1 base score of 9.8 (Critical). The CNA VulDB scores in the record are lower, ranging from 5.5 to 7.5 depending on CVSS version.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.