CVE Intelligence
Analysis AI-assisted

CVE-2026-1701: SQL Injection in itsourcecode School Management System 1.0 (/enrollment/index.php)

CVE-2026-1701 describes an SQL injection flaw in how /enrollment/index.php handles the ID argument in itsourcecode School Management System 1.0, which can be triggered remotely. NVD records a CVSS 3.1 base score of 9.8, and the record states that an exploit has been publicly disclosed. The sources consulted do not identify a fixed version, and the only listed fix entry is a third-party mitigation reference.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-1701 is an SQL injection issue involving the ID argument processed by /enrollment/index.php in itsourcecode School Management System 1.0. The CVE was published by VulDB as CNA. The original disclosure contained contradicting product definitions, and the CVE was first attached to the Student Management System before being corrected.

Impact

An attacker who can reach the affected page over the network may be able to influence database queries. The record does not describe which data could be read or modified, or what level of access could be gained. NVD scores the issue 9.8 under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which corresponds to high impact on confidentiality, integrity and availability with no privileges or user interaction required. The CNA scores listed in the record are lower (7.3 and 7.5 under CVSS 3.1 and 2.0, and 5.5 under CVSS 4.0).

Affected products and versions

The record lists itsourcecode School Management System version 1.0 as affected. No other versions are identified in the sources consulted. The product website is referenced only for product context.

Exploitation status

The record shows no CISA KEV listing, so no confirmed exploitation in the wild appears in the sources consulted. The description states that the exploit has been publicly disclosed and may be used, and the GitHub issue referenced by the record is tagged as Exploit. No EPSS or SSVC data is available in the record.

Remediation and mitigation

  • The record does not identify a vendor fixed version. The only listed fix entry is a mitigation reference to a GitHub issue.
  • Restrict access to the enrollment module to authorized users or trusted internal networks until a verified correction is available.
  • Ask the developer or maintainer for a corrected build, and review the code that handles the ID parameter so that database queries use parameterized statements and strict server-side input validation.
  • Consider a web application filter as a temporary compensating control, recognizing that it does not replace fixing the code.
  • If the application cannot be secured, isolate or retire it and review whether student enrollment data may have been exposed.

Detection guidance

  • Review web server and application logs for requests to /enrollment/index.php with unusual or malformed ID values.
  • Look for database error messages returned to clients, which can indicate that input is reaching queries unsafely.
  • Monitor for unexpected database activity, sudden changes in response times or unusually large data transfers from the application.
  • Alert on enrollment page requests from unfamiliar sources or at atypical volumes.

Limitations of the available information

The record provides no fixed version, no vendor advisory and no technical details beyond the statement that an exploit is public. Because the original disclosure had contradicting product definitions, administrators should confirm which codebase they run. The record lists CWE-74 (Injection) while the description refers specifically to SQL injection, and the sources consulted do not resolve this. The number of affected deployments and the current availability of the public exploit are unknown.

Frequently asked questions

Is this vulnerability known to be exploited in the wild?

No confirmed exploitation appears in the sources consulted, and the record shows no CISA KEV listing. The description does state that a public exploit has been disclosed and may be used.

Which versions are affected?

The record lists version 1.0 of itsourcecode School Management System. No other versions are identified in the sources consulted.

Is a fixed version available?

The record does not identify a fixed version. The only listed fix entry is a mitigation reference to a GitHub issue, so administrators should restrict access and check with the maintainer for a verified correction.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.