Executive brief
The itsourcecode Student Transcript Processing System, a web application used for managing academic records, contains a security flaw in its administrative module. An attacker can exploit this vulnerability to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive student information or the alteration of academic transcripts. This issue can be exploited remotely without requiring any login credentials, posing a significant risk to data integrity and privacy.
Technical details
A SQL injection vulnerability exists in itsourcecode Student Transcript Processing System 1.0 within the '/admin/modules/student/index.php' component. The root cause is the improper neutralization of the 'studentId' GET parameter before its use in a database query. A remote, unauthenticated attacker can provide malicious SQL payloads (including time-based blind and UNION-based techniques) to manipulate database queries. Successful exploitation allows for unauthorized data extraction, modification, or full database compromise. The exploit is currently public, and no official patch has been confirmed; users are advised to implement prepared statements and input validation manually.
Affected products
- itsourcecode Student Transcript Processing System 1.0
Timeline
- 2026-05-01: disclosed: Initial discovery and public issue report on GitHub
- 2026-05-26: advisory: CVE published and VulDB entry created