Executive brief
The itsourcecode Fees Management System, a web application used for tracking and managing student payments, contains a security vulnerability in its payment management component. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the theft of sensitive financial records, tampering with payment data, or disruption of the system's operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Fees Management System 1.0 within the /manage_payment.php file. The application fails to properly sanitize or validate the 'id' GET parameter before incorporating it into a database query. An authenticated attacker can exploit this by sending specially crafted SQL queries to perform boolean-based blind, error-based, or time-based blind injection attacks. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system control. A public proof-of-concept (PoC) using sqlmap has been disclosed. No official patch is currently noted, but remediation should involve implementing prepared statements and parameterized queries.
Affected products
- itsourcecode Fees Management System 1.0
Timeline
- 2026-05-14: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-02: advisory: CVE published and NVD record created