CVE-2026-2161: itsourcecode Directory Management System 1.0 SQL Injection in forget-password.php
CVE-2026-2161 is a SQL injection flaw in the /admin/forget-password.php file of itsourcecode Directory Management System 1.0, triggered through the email argument and reachable remotely. The NVD record carries a CVSS 3.1 base score of 9.8 (critical), while the CNA scores range from 2.0 to 4.0 versions. The record states that a public exploit exists, but CISA KEV does not list the CVE and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-2161 describes a SQL injection issue in the file /admin/forget-password.php of itsourcecode Directory Management System 1.0. According to the record, the email argument is not handled safely, which allows injected SQL to reach the database. The CVE is classified as CWE-74 (Injection) in the record.
Impact
Successful SQL injection can allow an attacker to read, modify or delete database content, depending on database permissions and application design. The record does not describe the specific data exposed or the level of access obtained. The NVD base score is 9.8 under CVSS 3.1 with high confidentiality, integrity and availability impact, and the vector indicates network access without privileges or user interaction.
Affected products and versions
- The record lists the affected product as Clive 21 Directory Management System, version 1.0.
- The description and vendor reference name itsourcecode Directory Management System 1.0. The naming difference should be verified against the vendor before inventory matching.
- No other affected versions are listed in the record.
Exploitation status
The record states that the exploit has been made public and could be used. The CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. Treat the public exploit availability as a reason for elevated urgency.
Remediation and mitigation
- No vendor fixed version is identified in the record. The only fix reference is a mitigation entry pointing to a third-party GitHub issue.
- Restrict access to the administrative path /admin/ to trusted networks until the application is verified as safe.
- Review the application code handling the password recovery form and apply parameterized queries and input validation, as is standard practice for this class of flaw.
- Monitor the vendor site and the referenced sources for an official update, and confirm the fix in a test environment before deployment.
Detection guidance
- Review web server and application logs for unusual or malformed requests to /admin/forget-password.php, especially requests with unexpected characters or repeated errors from database layers.
- Monitor database error messages and unusual query volumes originating from the web application account.
- Alert on access attempts to administrative paths from external addresses.
Limitations of the available information
The record does not identify a vendor advisory, a fixed version, the exact vulnerable code or the database backend. CNA CVSS scores differ from the NVD score (5.5 under 4.0, 7.3 under 3.1 and 7.5 under 2.0). The EPSS probability is 0.00433 with a percentile of 0.35837. SSVC data is absent. Product naming differs between the affected product field and the description.
Frequently asked questions
Is CVE-2026-2161 being actively exploited?
The record says a public exploit exists, but the CVE is not listed in CISA KEV and no confirmed exploitation in the wild appears in the sources consulted.
Is there an official fixed version?
No. The record does not identify a fixed version, only a mitigation reference to a third-party GitHub issue.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.