CVE-2026-2190: itsourcecode School Management System 1.0 SQL Injection
CVE-2026-2190 is an SQL injection flaw in itsourcecode School Management System 1.0, triggered by manipulating the ID argument in a controller file. NVD scores it 9.8 under CVSS 3.1, and the record states that an exploit has been made public. The CVE is not listed in CISA KEV, and the record contains no fixed version.
Overview
CVE-2026-2190 describes an SQL injection weakness (CWE-89) in itsourcecode School Management System 1.0. According to the record, the flaw sits in an unidentified function of the file /ramonsys/user/controller.php and is triggered by manipulating the ID argument. The official description states the attack can be launched remotely. The NVD entry and the VulDB entry are the main sources consulted.
Impact
SQL injection can allow an attacker who reaches the vulnerable input to influence database queries. The NVD CVSS 3.1 vector recorded for this CVE marks confidentiality, integrity and availability as high, with no privileges or user interaction required. Depending on the database configuration, consequences could include unauthorized reading or modification of school records. These consequences are an inference from the vulnerability class and the vector, not a confirmed outcome in the sources.
Affected products and versions
- itsourcecode School Management System, version 1.0 (the only version listed in the record).
- The record does not list other affected versions. Whether earlier or later builds are affected is unknown.
Exploitation status
The record states that an exploit has been released to the public. The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted. A reference tagged as an exploit is present in the record, but this analysis does not describe or reproduce its content.
Remediation and mitigation
- The record lists no fixed version, so the correction status is unknown. The absence of data does not mean no fix exists.
- Check the vendor site for an updated release or advisory before relying on any patch.
- Until a fix is verified, restrict access to the affected application to trusted networks and authorized users.
- Review the code that handles the ID parameter and move database access to parameterized queries or prepared statements.
- Use least-privilege database accounts for the application so that a successful injection has limited reach.
Detection guidance
- Review web server and application logs for unusual or malformed values in the ID parameter on requests to the affected controller.
- Monitor database error messages returned to clients and treat unexpected SQL errors as a signal to investigate.
- Consider a web application firewall with rules tuned to this application. Such rules are a supplementary control and not a substitute for a fix.
Limitations of the available information
The record does not name the vulnerable function, the HTTP method, the database engine, or any fixed version. CVSS scores differ across providers: NVD gives 9.8 under CVSS 3.1, while the CNA lists 7.3 under 3.1, 5.5 under 4.0 and 7.5 under 2.0. The EPSS probability is 0.00429 with percentile 0.35405. Vendor status and patch availability could not be confirmed from the data provided.
Frequently asked questions
Is CVE-2026-2190 being actively exploited?
The record states that a public exploit has been released, but the CVE is not listed in CISA KEV and no confirmed active exploitation appears in the sources consulted.
Is there a fixed version for this SQL injection flaw?
The record lists no fixed version and no vendor patch. The status is unknown, so check the vendor site and verify any update before relying on it.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.