CVE-2026-2013: itsourcecode Student Management System 1.0 SQL Injection via ID Parameter
A SQL injection weakness (CWE-89) was reported in itsourcecode Student Management System 1.0 in the file /ramonsys/soa/index.php, through the ID argument. The record describes remote exploitation and states that a public exploit is available, and NVD assigns a CVSS 3.1 base score of 9.8. CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-2013 is an SQL injection weakness (CWE-89) in itsourcecode Student Management System 1.0. According to the record, the flaw is reachable through the ID argument of the file /ramonsys/soa/index.php. The CVE was published on 2026-02-06 with VulDB as the CNA. The product vendor site is itsourcecode.com and the VulDB entry is at VulDB entry.
Impact
- The NVD base score is 9.8 under CVSS 3.1. The vector describes network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
- SQL injection generally allows an attacker to influence database queries. The specific data that could be read or changed in this application is unknown from the record.
- The CNA VulDB lists other scores (CVSS 4.0 at 5.5, CVSS 3.1 at 7.3, CVSS 2.0 at 7.5). These differ from the NVD score and should be read with that in mind.
Affected products and versions
- The affected entry names Itsourcecode School Management System, version 1.0.
- The description names Student Management System 1.0. The record does not confirm whether these names refer to the same product.
- No fixed version is listed in the record.
Exploitation status
- The record states that the exploit is publicly available and might be used. A GitHub issue tagged as an exploit reference is listed at GitHub issue.
- CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- No vendor fix is identified in the record. The absence of a listed fix does not mean no fix exists, so confirm the status with the vendor or a trusted source.
- Restrict access to the application to trusted networks until a fix or an official update is confirmed.
- If the software is customized in-house, adopt parameterized queries and strict validation of numeric identifiers.
- Consider disabling or removing the application if it is not in active use.
Detection guidance
- Review web server logs for requests to /ramonsys/soa/index.php with unusual or non-numeric values in the ID parameter.
- Watch application and database logs for unexpected query errors or responses that expose database details.
- Monitor for unexpected changes or deletions in student or administrative records.
Limitations of the available information
- The record does not describe the exact vulnerable code path or the full preconditions. The NVD vector indicates no privileges required, but the record does not further explain authentication or configuration requirements.
- The record does not include a vendor advisory, an EPSS score or an SSVC decision.
- The product name differs between the affected entry and the description, so version coverage should be verified against the installed software.
Frequently asked questions
What is CVE-2026-2013?
It is an SQL injection weakness (CWE-89) in itsourcecode Student Management System 1.0, reachable through the ID argument of /ramonsys/soa/index.php, according to the record.
Is this CVE known to be exploited in the wild?
CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted. The record does state that a public exploit is available.
Is there a fixed version?
No fixed version is listed in the record. The absence of a listed fix does not confirm that none exists, so check with the vendor.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.