CVE Intelligence
Analysis AI-assisted

CVE-2026-2116: itsourcecode Society Management System: SQL injection in edit_expenses.php

A SQL injection weakness was reported in the /admin/edit_expenses.php file of itsourcecode Society Management System 1.0, where the expenses_id argument is not handled safely. The record states the issue can be triggered remotely and that exploit details have been made public. No fixed version is listed in the sources consulted, so administrators should restrict access and review the affected application.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an SQL injection issue in the file /admin/edit_expenses.php of itsourcecode Society Management System 1.0. Manipulating the expenses_id argument is said to lead to SQL injection, and the attack can be launched remotely. The record classifies the weakness under CWE-74 (Injection), a broader class than SQL injection specifically.

Impact

  • If exploited, SQL injection could allow unauthorized reading or modification of data stored by the application's database, depending on configuration and database privileges (inference).
  • NVD assigns a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact. The CNA, VulDB, lists 7.3 under CVSS 3.1, 7.5 under CVSS 2.0 and 5.5 under CVSS 4.0.

Affected products and versions

  • The record lists the affected product as Angeljudesuarez Society Management System, version 1.0. The description names it as itsourcecode Society Management System 1.0, so the vendor attribution differs between fields.
  • No fixed versions are listed in the record.

Exploitation status

  • The record states that the exploit has been disclosed to the public and may be used. A GitHub issue tagged as an exploit is among the references.
  • The CISA KEV catalog does not list this CVE in the record. No confirmed active exploitation is documented in the sources consulted.
  • The EPSS probability is 0.00429 with a percentile of 0.35404, as recorded.

Remediation and mitigation

  • No vendor fix is identified in the record. Check the vendor website and contact the vendor for an update or guidance.
  • Until a fix is confirmed, restrict access to the /admin area to trusted networks and accounts, and consider removing or disabling the module if it is not needed.
  • Adopt parameterized queries or prepared statements for database access, and validate expected input types for identifiers such as expenses_id.
  • Apply least privilege to the application's database account to limit the impact of any injection.

Detection guidance

  • Review web server and application logs for requests to edit_expenses.php that contain unexpected or malformed values in the expenses_id parameter.
  • Monitor database error logs for SQL errors originating from the application.
  • Consider web application firewall monitoring for injection-related patterns on this endpoint, while recognizing that filtering alone is not a complete control.

Limitations of the available information

  • No fixed version or vendor advisory is present in the record.
  • The vendor name differs between the affected product field and the description, and the title field was empty in the source record.
  • The NVD and CNA CVSS scores differ; the record does not explain the difference.
  • Whether the 'Permissions Required' tag on a VulDB reference means authentication is needed is not stated in the description and should be verified.
  • SSVC data is absent from the record.

Frequently asked questions

What is the vulnerability in CVE-2026-2116?

The record describes an SQL injection in the expenses_id argument of /admin/edit_expenses.php in itsourcecode Society Management System 1.0.

Is a fix available?

No fixed version is listed in the record or the sources consulted. Check the vendor and apply the mitigations described until a fix is confirmed.

Is this vulnerability known to be actively exploited?

The CVE is not listed in CISA KEV in the record, and no confirmed active exploitation is documented in the sources consulted. The record does state that an exploit has been made public.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.