CVE-2026-2189: itsourcecode School Management System SQL Injection

Overview

CVE-2026-2189 describes an SQL injection issue in itsourcecode School Management System 1.0. According to the record, the problem sits in an unidentified function of the file /ramonsys/report/index.php, where manipulation of the argument named ay can lead to SQL injection. The weakness is recorded under CWE-74 (Injection).

Impact

SQL injection can allow an attacker to alter how the application builds database queries, which may expose, modify or destroy stored data and affect the availability of the application. The NVD assessment is 9.8 (critical) under CVSS 3.1, reflecting network reachability, low complexity, no required privileges, no user interaction and high impact on confidentiality, integrity and availability. Other CVSS entries supplied by the CNA, VulDB, are 5.5 under CVSS 4.0, 7.3 under CVSS 3.1 and 7.5 under CVSS 2.0, so the severity depends on which assessment is used.

Affected products and versions

• Product: Itsourcecode School Management System
• Version recorded as affected: 1.0

The record does not list any other affected versions, and it does not state whether later releases are affected.

Exploitation status

The record states that an exploit is publicly available and might be used. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00429, which is a model estimate and not evidence of exploitation.

Remediation and mitigation

• No fixed version or vendor patch is listed in the record. The absence of a listed fix does not confirm that none exists, so the status should be verified directly with the vendor through itsourcecode.
• If the affected application is in use, restrict access to the management and reporting interfaces to trusted networks until a fix or a reviewed code change is available.
• Ask the developer or maintainer to review database access in the affected file and to use parameterized queries and strict input validation for every user-supplied value.
• Consider a web application firewall as a temporary compensating control, recognizing that it is not a substitute for correcting the code.
• If the software is not essential, plan its removal or replacement.

Detection guidance

• Review web server and application logs for unusual or repeated requests to /ramonsys/report/index.php, especially requests with abnormal lengths or unexpected characters in query or form parameters.
• Check database error logs for syntax errors or query failures that originate from the reporting module.
• Monitor for unexpected data reads, changes or new accounts in the application database.

Limitations of the available information

The record does not identify the vulnerable function in detail, does not provide vendor advisory text, and lists no fixed version. The CWE assignment is the generic Injection category, and the CVSS scores differ between CNA and NVD entries. Organizations should confirm the affected code path and exposure in their own environment before deciding on response priority.

Frequently asked questions

Which software and versions are affected by CVE-2026-2189?

The record lists itsourcecode School Management System version 1.0 as affected. It does not list other versions, so the status of other releases is unknown.

Is CVE-2026-2189 known to be exploited in the wild?

The record says a public exploit is available, but the vulnerability is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

Is there a vendor fix for CVE-2026-2189?

No fix is listed in the record. The absence of a listed fix does not prove none exists, so confirm the status with the vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.