Executive brief
itsourcecode Content Management System 1.0 is a web application used for managing digital content. A security vulnerability in the system allows remote attackers to perform SQL injection, which could lead to unauthorized access to the database, data theft, or modification of website content. This could compromise the integrity of the site and expose sensitive information stored in the database.
Technical details
A SQL injection vulnerability exists in itsourcecode Content Management System 1.0 within the /instructions.php component. The root cause is the improper sanitization of the 'topic_id' GET parameter before it is used in a SQL query. An attacker can exploit this by sending specially crafted SQL queries (including time-based blind and UNION-based techniques) to the server. While some reports suggest authentication is required (PR:L), others indicate no authentication is necessary. Successful exploitation allows for unauthorized database access, data leakage, and potential system control. No official patch is currently available; users are advised to implement prepared statements and input validation.
Affected products
- itsourcecode Content Management System 1.0
Timeline
- 2026-05-08: disclosed: Vulnerability reported on GitHub by ltranquility
- 2026-06-01: advisory: CVE-2026-10242 published by NVD/VulDB