Executive brief
The itsourcecode Fees Management System, a web application used for tracking student financial records, contains a security vulnerability in its student management component. An authenticated user can exploit this flaw to perform unauthorized database operations. This could lead to the exposure of sensitive student information, data tampering, or disruption of the management system's operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Fees Management System 1.0 within the 'manage_student.php' file. The application fails to properly sanitize or validate the 'id' GET parameter before using it in a database query. An attacker with valid login credentials can exploit this by sending crafted SQL queries, including boolean-based blind and error-based payloads. Successful exploitation allows for unauthorized database access, sensitive data extraction, and potential system control. No official patch is currently documented, but remediation involves implementing prepared statements and parameterized queries.
Affected products
- itsourcecode Fees Management System 1.0
Timeline
- 2026-05-16: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-06-04: advisory: NVD publication date