Executive brief
The itsourcecode Fees Management System, a web application used for managing educational or institutional fees, contains a security vulnerability in its receipt generation component. An attacker with basic user credentials can exploit this flaw to gain unauthorized access to the underlying database. This could lead to the theft of sensitive financial records, tampering with payment data, or disruption of the fee management service.
Technical details
A SQL injection vulnerability exists in itsourcecode Fees Management System 1.0 within the '/receipt.php' file. The application fails to properly sanitize or validate the 'ef_id' GET parameter before using it in a database query. A remote attacker with low-level authenticated access can provide malicious SQL payloads to perform boolean-based blind, error-based, time-based blind, or UNION-based attacks. Successful exploitation allows for unauthorized database access, data exfiltration, and potential system control. No official patch is currently noted, but remediation involves implementing prepared statements with parameter binding.
Affected products
- itsourcecode Fees Management System 1.0
Timeline
- 2026-05-22: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-06-04: advisory: CVE-2026-10811 published.