Executive brief
itsourcecode Electronic Judging System is a platform used for managing and scoring competitions. A security vulnerability in the administrative interface allows remote attackers to interfere with the underlying database. This could lead to the theft of sensitive competition data, unauthorized modification of scores, or disruption of the judging service.
Technical details
A SQL injection vulnerability exists in itsourcecode Electronic Judging System 1.0 within the /admin/edit_judge.php component. The root cause is the improper neutralization of the 'judge_id' GET parameter before its use in a SQL query. A remote, unauthenticated attacker can exploit this by sending specially crafted SQL commands to the server. Successful exploitation allows for boolean-based blind, time-based blind, and UNION-based SQL injection, potentially leading to full database extraction or unauthorized data modification. No patches are currently known to be available; developers are advised to implement prepared statements and parameterized queries.
Affected products
- itsourcecode Electronic Judging System 1.0
Timeline
- 2026-04-28: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-05-26: advisory: CVE published and VulDB entry created