CVE-2026-2115: itsourcecode Society Management System 1.0 SQL Injection in delete_expenses.php
CVE-2026-2115 describes an SQL injection flaw in itsourcecode Society Management System 1.0, reachable through the expenses_id argument of /admin/delete_expenses.php. The NVD assigns a CVSS 3.1 base score of 9.8 (critical), and the record states that an exploit has been published. The CVE is not listed in the CISA KEV catalog, and no fixed version is recorded in the sources consulted.
Overview
CVE-2026-2115 is a flaw in itsourcecode Society Management System 1.0 that the record classifies as injection (CWE-74, Injection). The issue is tied to the file /admin/delete_expenses.php and its expenses_id argument, and the record describes SQL injection as the result. According to the record, the issue can be triggered remotely.
Impact
SQL injection can let an attacker affect the application database in ways the developers did not intend, such as reading, changing or deleting data. The NVD base score of 9.8 corresponds to a network-reachable vector with low complexity, no privileges required, no user interaction and high impact on confidentiality, integrity and availability. The actual impact depends on each deployment and is not described in the sources.
Affected products and versions
- The affected-product field lists Society Management System, version 1.0.
- The description names itsourcecode as the product owner, while the affected-product field names Angeljudesuarez. The record does not resolve this discrepancy.
- No fixed version is listed in the record.
Exploitation status
- The record states that the exploit has been published and may be used. A GitHub issue tagged as an exploit reference is among the references.
- The CVE is not listed in CISA KEV, so no confirmed active exploitation appears in the sources consulted.
- FIRST EPSS gives a probability of 0.00379 and a percentile of 0.29976 in the record.
Remediation and mitigation
- No vendor fix is recorded. Check whether this application is deployed in your environment before taking further steps.
- Restrict access to administrative paths such as /admin using network controls and strong authentication, and avoid exposing the application to the internet.
- Review the source code for parameterized queries and input validation in the affected file, or replace the component with a maintained alternative.
- Monitor the VulDB entry and the NVD record for updates.
Detection guidance
- Review web server and application logs for unusual requests to delete_expenses.php, especially those with unexpected parameter values or database error messages.
- If a web application firewall is in use, check for alerts related to SQL injection patterns on this path.
- Audit database activity for unexpected deletions or queries originating from the web application account.
Limitations of the available information
- No fixed version or vendor advisory is recorded.
- The vendor name differs between the description and the affected-product field.
- The record does not describe the real-world exposure or the number of deployments.
- Analysis uses the record and the listed references only, which may not be complete.
Frequently asked questions
Is CVE-2026-2115 being actively exploited?
The record says an exploit has been published, but the CVE is not listed in CISA KEV. No confirmed active exploitation appears in the sources consulted.
Is there a fixed version for this issue?
No fixed version is listed in the record. Until a vendor fix is available, restrict access to the affected administrative path and review the application code.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.