CVE Intelligence
Analysis AI-assisted

CVE-2026-2073: itsourcecode School Management System SQL Injection

CVE-2026-2073 is an SQL injection weakness (CWE-89) in itsourcecode School Management System 1.0, affecting the ID argument handled by /ramonsys/user/index.php. NVD rates it Critical with a CVSS 3.1 base score of 9.8, and the record states that an exploit has been publicly disclosed. The record shows no confirmed active exploitation and no vendor fix.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A SQL injection weakness (CWE-89) was reported in itsourcecode School Management System 1.0. The record places it in the ID argument handled by /ramonsys/user/index.php, within a function the record does not describe. The sources state that the issue can be triggered remotely and that an exploit has been publicly disclosed.

Impact

  • Successful SQL injection can allow an attacker to read, change or delete database content, depending on database permissions and application design.
  • NVD lists a base score of 9.8 (CVSS 3.1, Critical) with high confidentiality, integrity and availability impact.
  • The CNA, VulDB, lists lower scores under other CVSS versions, as shown in the record.

Affected products and versions

  • Itsourcecode School Management System, version 1.0, as stated in the record.
  • The record lists no other affected versions. Whether other releases are affected is unknown.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation appears in the sources consulted.
  • The record states that an exploit has been publicly disclosed, and a public issue tagged as exploit is referenced. Public availability increases the likelihood of opportunistic exploitation.

Remediation and mitigation

  • The record lists no fixed version or vendor patch. Check the vendor site and contact the vendor for an update.
  • Until a fix is confirmed, restrict network access to the application, especially administrative or user-facing pages, and require authentication where possible.
  • Ensure database queries use parameterized statements and that the ID input is validated on the server side.
  • Apply least privilege to the database account used by the application.

Detection guidance

  • Review web server and application logs for unusual values in the ID parameter of requests to the affected file, such as malformed input or database error messages.
  • Monitor for unexpected database errors or abnormal data access originating from the web application.
  • Web application firewall alerts for SQL-related patterns may help, but they do not replace a code fix.

Limitations of the available information

  • The record does not describe the vulnerable function in detail or confirm the affected versions beyond 1.0.
  • No fixed version, vendor advisory or patch appears in the record.
  • The EPSS probability is a statistical estimate and not a confirmed threat assessment.
  • Scores and details may change as the CNA and NVD update the record.

Frequently asked questions

What is CVE-2026-2073?

It is an SQL injection vulnerability (CWE-89) in itsourcecode School Management System 1.0, reached through the ID argument of /ramonsys/user/index.php.

How severe is it?

The NVD record gives a CVSS 3.1 base score of 9.8, rated Critical. Other CNA scores in the record are lower.

Is it being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted. The record does state that an exploit has been publicly disclosed.

Is there a fix?

The record lists no fixed version or vendor patch. Contact the vendor and restrict access to the application until an update is confirmed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.