CVE Intelligence
Analysis AI-assisted

CVE-2026-2014: itsourcecode Student Management System 1.0 SQL Injection

CVE-2026-2014 is an SQL injection weakness in itsourcecode Student Management System 1.0, triggered through the ID argument of the /ramonsys/billing/index.php file. The record states that remote exploitation is possible and that an exploit has been publicly released. NVD assigns a CVSS 3.1 base score of 9.8 (critical), and CISA KEV does not list this CVE.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-2014 is an SQL injection weakness (CWE-89) reported in itsourcecode Student Management System 1.0. According to the record, the flawed function is in /ramonsys/billing/index.php, where the ID argument is not handled safely.

Impact

  • The record describes remote exploitation, so a party with network access to the application may be able to reach the affected parameter.
  • Depending on configuration, SQL injection can expose, alter or delete data in the back-end database. This is an inference; the sources do not confirm a specific outcome.
  • NVD rates the base score at 9.8 (critical) under CVSS 3.1, with high confidentiality, integrity and availability impact.

Affected products and versions

  • Product: itsourcecode Student Management System 1.0. The affected data lists it as Itsourcecode School Management System, version 1.0.
  • The record does not list any fixed version.
  • Other CNA scores in the record (VulDB) are 7.3 under CVSS 3.1, 5.5 under 4.0 and 7.5 under 2.0.

Exploitation status

  • The record states that an exploit has been released publicly and may be used for attacks. A GitHub issue tagged as an exploit is referenced.
  • This CVE is not listed in CISA KEV, so the sources consulted do not confirm exploitation in the wild.
  • EPSS and SSVC data are not present in the record.

Remediation and mitigation

  • Identify whether the product is deployed. If it is, restrict access to administrative and billing modules to trusted networks.
  • Contact the vendor or project maintainers for a fixed release. The record provides none.
  • Apply secure coding measures: parameterized queries or prepared statements for the ID input, strict server-side input validation, and a least-privilege database account.
  • A web application firewall may serve as a temporary compensating control, but it does not replace correcting the code.

Detection guidance

  • Review web server and application logs for requests to /ramonsys/billing/index.php with unusual or malformed ID values.
  • Watch for database errors returned to clients and for unexpected query volume from the application account.
  • Verify database account privileges and audit recent changes to billing and student records.

Limitations of the available information

  • The record does not identify the exact vulnerable code path, a fixed version, or the vendor patch status.
  • The description names the product as Student Management System, while the affected entry names it School Management System. This analysis assumes they refer to the same product.
  • EPSS and SSVC data are unavailable, and the KEV ransomware field is empty.

Frequently asked questions

What is CVE-2026-2014?

It is an SQL injection weakness in itsourcecode Student Management System 1.0, reached through the ID argument of /ramonsys/billing/index.php.

Is this CVE known to be exploited in the wild?

CISA KEV does not list it, and the sources consulted do not confirm exploitation in the wild. The record does state that a public exploit has been released.

Is a fixed version available?

The record does not list a fixed version. Contact the vendor or maintainers and apply secure coding measures in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.