Executive brief
A vulnerability exists in the itsourcecode Electronic Judging System, a platform used for managing and scoring competitions. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive information or the disruption of the judging process. This issue can be exploited remotely without requiring any user login or special permissions.
Technical details
A SQL injection vulnerability exists in itsourcecode Electronic Judging System 1.0 within the '/admin/delete_judge.php' component. The root cause is the improper neutralization of the 'judge_id' parameter before its use in a SQL query. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request containing malicious SQL commands. Successful exploitation allows for unauthorized database access, data exfiltration, and potential modification or deletion of records. A public proof-of-concept (PoC) using a time-based sleep payload has been disclosed. No official patch is currently documented, but remediation should involve implementing prepared statements and parameterized queries.
Affected products
- itsourcecode Electronic Judging System 1.0
Timeline
- 2026-04-28: disclosed: Vulnerability details and PoC shared on GitHub
- 2026-05-26: advisory: NVD and VulDB published advisory details