CVE Intelligence
Analysis AI-assisted

CVE-2026-2012: itsourcecode Student Management System 1.0 SQL Injection

CVE-2026-2012 describes an SQL injection flaw in itsourcecode Student Management System 1.0, reachable remotely through the facultyloading page. The CNA (VulDB) and NVD rate it critical, with NVD assigning CVSS 3.1 9.8. The record states that an exploit has been publicly disclosed, but the CVE is not listed in the CISA KEV catalog.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2012 affects the itsourcecode Student Management System 1.0. According to the record, a function reachable through the file /ramonsys/facultyloading/index.php does not properly handle the ID argument, which leads to SQL injection (CWE-89). The record states the attack can be started remotely. The vulnerability was published on 2026-02-06 and analyzed by the CNA VulDB.

Impact

SQL injection can allow an attacker to influence the database queries an application sends, potentially affecting data read, modified or disrupted. The NVD CVSS 3.1 vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicates network access, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. The exact business impact depends on the database content and deployment, which the sources do not describe.

Affected products and versions

  • Product: Itsourcecode School Management System (listed in the affected entry), described in the vulnerability text as Student Management System.
  • Version: version 1.0 is the only version listed in the record.
  • Fixed versions: none are listed in the record.

The product name differs between the affected entry and the description, so administrators should confirm which application package they run.

Exploitation status

The CVE is not listed in the CISA KEV catalog, so this analysis does not report active exploitation. The record states that an exploit has been publicly disclosed and may be used, and a GitHub issue tagged as an exploit reference is included in the sources. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • No vendor fix or patched version is identified in the record. The absence of a listed fix is not proof that none exists, so check with the vendor at itsourcecode.
  • Restrict access to the application so that it is not exposed to untrusted networks, especially the facultyloading module.
  • Ask developers to review the affected file and replace dynamically built database queries with parameterized queries and strict input validation.
  • Apply web application firewall rules as a temporary compensating control while code review is pending, recognizing they can be bypassed.
  • Limit database account privileges used by the application to the minimum required.

Detection guidance

  • Review web server and application logs for unusual or repeated requests to the facultyloading path with abnormal values in the ID argument.
  • Monitor database logs for query errors or unexpected query patterns originating from the web application.
  • Watch for unexpected changes to student or faculty records as a sign of possible misuse.

For the public entries, see the VulDB entry and the NVD record.

Limitations of the available information

  • No fixed version, vendor advisory or patch is identified in the record.
  • CVSS values differ by source: NVD provides 3.1 at 9.8, while the CNA provides 4.0 at 5.5, 3.1 at 7.3 and 2.0 at 7.5.
  • EPSS and SSVC data are not available in the record.
  • The affected product name in the structured data differs from the name in the description.
  • The exact exploit details are not included here, and the record does not specify the exploit's maturity.

Frequently asked questions

What is CVE-2026-2012?

It is an SQL injection vulnerability in itsourcecode Student Management System 1.0, affecting the facultyloading file and the ID argument, according to the record.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The record does state that a public exploit has been disclosed.

Is there a fixed version?

No fixed version is listed in the record. Contact the vendor and restrict access to the application until a fix or a verified mitigation is available.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.