Executive brief
itsourcecode Fees Management System is a web-based application used to manage student fees and financial records. A security vulnerability in the system's login processing allows an authenticated user to perform a SQL injection attack. If exploited, this could allow an attacker to access sensitive database information, tamper with financial records, or disrupt the availability of the management system.
Technical details
A SQL injection vulnerability exists in itsourcecode Fees Management System 1.0 within the /ajax.php file. The root cause is the failure of the application to properly sanitize or validate the 'Username' parameter before using it in a database query. An attacker with valid login credentials can manipulate this parameter via a POST request to execute arbitrary SQL commands. A publicly disclosed proof-of-concept demonstrates a time-based blind SQL injection attack using the SLEEP() function. Successful exploitation can lead to unauthorized database access, data leakage, and potential system control.
Affected products
- itsourcecode Fees Management System 1.0
Timeline
- 2026-05-12: disclosed: Vulnerability details and PoC published on GitHub
- 2026-06-01: advisory: CVE-2026-10296 published by NVD/VulDB