Executive brief
itsourcecode Electronic Judging System is a web application used for managing and scoring competitions. A security vulnerability in the system's administrative component allows remote attackers to interfere with the underlying database. If exploited, an attacker could gain unauthorized access to sensitive competition data, modify records, or potentially disrupt the judging process entirely without needing a login.
Technical details
A SQL injection vulnerability exists in itsourcecode Electronic Judging System 1.0 within the '/admin/edit_team.php' file. The root cause is the improper neutralization of special elements in the 'num_id' GET parameter, which is used directly in SQL queries without sufficient validation or sanitization. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests to perform boolean-based blind, time-based blind, or UNION-based SQL injection attacks. Successful exploitation allows for unauthorized database access, data exfiltration, and potential administrative takeover. No official patch is currently available, but it is recommended to implement prepared statements with parameterized queries.
Affected products
- itsourcecode Electronic Judging System 1.0
Timeline
- 2026-04-28: disclosed: Vulnerability details and PoC shared on GitHub.
- 2026-05-26: advisory: CVE-2026-9526 published.