Executive brief
The itsourcecode Fees Management System, a web application used for tracking and managing student fees, contains a security vulnerability in its user management component. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the theft of sensitive student information, unauthorized modification of financial records, or disruption of the system's operations.
Technical details
A SQL injection vulnerability exists in itsourcecode Fees Management System 1.0 within the '/manage_user.php' file. The application fails to properly sanitize or validate the 'id' GET parameter before using it in a database query. An authenticated attacker can provide malicious SQL payloads (including boolean-based blind, time-based blind, and UNION-based techniques) to manipulate queries. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system compromise. A public exploit (PoC) has been released, and the vendor is advised to implement prepared statements with parameter binding to remediate the issue.
Affected products
- itsourcecode Fees Management System 1.0
Timeline
- 2026-05-20: disclosed: Vulnerability details and PoC shared on GitHub by researcher jocker-king253
- 2026-06-04: advisory: CVE-2026-10809 published to the NVD