Executive brief
A vulnerability exists in the itsourcecode Fees Management System, a software used for tracking and managing educational or service fees. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the theft of sensitive financial records, tampering with payment data, or disruption of the management system's operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Fees Management System 1.0 within the '/manage_fee.php' file. The application fails to properly sanitize or validate the 'id' GET parameter before using it in a database query. A remote attacker with low-privileged authentication can exploit this via boolean-based blind, error-based, or time-based blind techniques to execute arbitrary SQL commands. This allows for unauthorized data extraction, modification, or deletion within the MySQL database. No official patch is currently noted, but remediation involves implementing prepared statements and parameterized queries.
Affected products
- itsourcecode Fees Management System 1.0
Timeline
- 2026-05-13: disclosed: Initial vulnerability report on GitHub
- 2026-06-02: advisory: NVD publication date