CVE Intelligence
Analysis AI-assisted

CVE-2026-2117: SQL Injection in itsourcecode Society Management System 1.0

A SQL injection flaw has been reported in the activity_id argument of /admin/edit_activity.php in itsourcecode Society Management System 1.0. NVD scores it CVSS 3.1 9.8 (Critical), and the record notes that an exploit has been made public. The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A SQL injection vulnerability has been reported in an unidentified function of /admin/edit_activity.php in itsourcecode Society Management System 1.0, triggered through the activity_id argument. The CNA (VulDB) states the attack can be started remotely, and the record notes that an exploit has been made public. NVD lists a CVSS 3.1 base score of 9.8.

Impact

  • Successful SQL injection could allow an attacker to read or alter database content. The exact effect depends on how the application uses its database (inference).
  • The NVD vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network access, low complexity, no required privileges, no user interaction, and high impact on confidentiality, integrity and availability.
  • The CWE assigned is CWE-74 (Injection).

Affected products and versions

  • The record lists the affected product as Angeljudesuarez Society Management System, version 1.0.
  • The description refers to itsourcecode Society Management System 1.0. The vendor and product naming is inconsistent between fields.
  • No fixed version is listed in the record.

Exploitation status

  • The CVE is not listed in CISA KEV in the record. No confirmed active exploitation appears in the sources consulted.
  • A GitHub issue tagged as an exploit is referenced, and the record states that the exploit has been made public. Public exploit material increases risk, but it does not confirm exploitation in the wild.
  • The recorded EPSS probability is 0.00376 with a percentile of 0.29667, dated 2026-10-13.

Remediation and mitigation

  • No vendor fix is listed in the record. The absence of a listed fix does not mean none exists, so check the product source and vendor channels directly.
  • If the application cannot be patched or replaced, restrict access to administrative paths using network controls, VPN access or IP allowlisting.
  • Developers should use parameterized queries and strict input validation for all database-bound parameters.
  • If the software is not needed, disable or remove it and move to a maintained alternative.
  • Review database account privileges and rotate credentials if compromise is suspected.

Detection guidance

  • Review web server logs for requests to /admin/edit_activity.php that carry unusual characters or unexpected values in activity_id.
  • Look for database error messages, unexpected query patterns or unexplained changes to activity records.
  • Web application firewall alerts for SQL injection patterns can help, but they should not be treated as complete protection.

Limitations of the available information

  • The record contains no fixed version and no vendor advisory.
  • The vendor and product names differ between the affected-product field and the description.
  • The NVD vector indicates no privileges are required, while one VulDB reference is tagged Permissions Required. This should be verified.
  • CVSS scores differ by provider: 9.8 (NVD, 3.1), 7.3 (CNA, 3.1), 5.5 (CNA, 4.0) and 7.5 (CNA, 2.0).
  • The range of affected versions beyond 1.0 is unknown.
  • The exploit referenced in the record was not reviewed, and this analysis does not describe its details.

Frequently asked questions

Is CVE-2026-2117 being actively exploited?

The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted. The record does reference a public exploit, so the risk should be treated as elevated.

Which version is affected?

The record lists version 1.0 of the Society Management System. The affected product naming differs between fields, and no broader version range is given.

Is there a fixed version?

No fixed version is listed in the record. Check the vendor or product source directly, since a missing entry does not confirm that no fix exists.

What should administrators do now?

Restrict access to administrative paths, consider disabling the application if it is not required, and review database privileges and logs for suspicious activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.