Executive brief
itsourcecode Electronic Judging System, a platform used for managing and scoring competitions, contains a security vulnerability in its administrative interface. An attacker can exploit this flaw to execute unauthorized database commands, potentially leading to the theft of sensitive competition data or the modification of judging results. This could undermine the integrity of the judging process and result in unauthorized access to the underlying server information.
Technical details
A SQL injection vulnerability exists in itsourcecode Electronic Judging System 1.0 within the '/intrams/admin/add_judges.php' file. The root cause is the failure to properly sanitize or validate the 'fname' parameter before using it in a SQL query. A remote attacker with low privileges (or potentially no authorization, as per conflicting reports) can provide a malicious payload to manipulate database queries. Successful exploitation allows for unauthorized database access, sensitive data leakage, and potential data tampering. A public proof-of-concept utilizing a time-based blind SQL injection (SLEEP) has been disclosed.
Affected products
- itsourcecode Electronic Judging System 1.0
Timeline
- 2026-06-15: disclosed: Initial disclosure on GitHub issues
- 2026-07-14: advisory: NVD publication date