Executive brief
A security vulnerability exists in the itsourcecode Fees Management System, a software platform used for tracking and managing educational fees. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the theft of sensitive student financial records, tampering with payment data, or disruption of the management system's operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Fees Management System 1.0 within the '/manage_course.php' component. The application fails to properly sanitize the 'id' GET parameter before using it in a database query. An attacker with low-privileged authentication can perform boolean-based blind or UNION-based SQL injection attacks. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. A public proof-of-concept (PoC) using sqlmap has been disclosed. No official patch is currently documented; remediation should involve implementing prepared statements and parameterized queries.
Affected products
- itsourcecode Fees Management System 1.0
Timeline
- 2026-05-12: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-06-01: advisory: CVE-2026-10297 published.