Executive brief
A vulnerability exists in the itsourcecode Content Management System, a platform used for managing website content. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the alteration of site data. This could result in a loss of data integrity and a significant impact on business operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Content Management System 1.0 within the '/admin/edit_topic.php' component. The application fails to properly sanitize or validate the 'topic_id' GET parameter before using it in a SQL query. A remote attacker with low-level privileges (or potentially no authentication, as reports conflict) can provide a malicious payload, such as a UNION-based query, to extract sensitive data from the database or perform unauthorized operations. The exploit is publicly available and involves manipulating the topic_id argument to bypass intended query logic. Developers are advised to implement prepared statements and parameter binding to mitigate this risk.
Affected products
- itsourcecode Content Management System 1.0
Timeline
- 2026-05-10: disclosed: Vulnerability discovered and reported by researcher Mr-Elymas.
- 2026-06-01: advisory: NVD and VulDB published the vulnerability details.