Executive brief
itsourcecode Content Management System 1.0 is a PHP-based platform used for managing website content. A security flaw in the administrative image update component allows an attacker to manipulate database queries. This could lead to unauthorized access to sensitive information, data tampering, or disruption of the website's operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Content Management System 1.0 within the '/admin/update_ss_img.php' file. The root cause is the improper neutralization of special elements in the 'topic_id' GET parameter. While some reports suggest authentication is required (PR:L), others indicate the exploit may be reachable without prior access. A successful exploit allows a remote attacker to execute arbitrary SQL commands via UNION-based queries, potentially leading to full database compromise. A public proof-of-concept (PoC) using sqlmap has been released.
Affected products
- itsourcecode Content Management System Project In PHP 1.0
Timeline
- 2026-05-09: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-06-01: advisory: NVD and VulDB publish advisory.