Executive brief
A security vulnerability has been identified in the itsourcecode Student Transcript Processing System, a software package used to manage and generate academic transcripts. This flaw allows an attacker to manipulate database queries remotely without needing a username or password. Successful exploitation could lead to unauthorized access to student records, data theft, or the modification of academic information, potentially damaging the institution's reputation and data integrity.
Technical details
A SQL injection vulnerability exists in itsourcecode Student Transcript Processing System 1.0 within the '/admin/modules/student/trans.php' file. The application fails to properly sanitize or validate the 'studentId' and 'cid' GET parameters before using them in SQL queries. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests containing malicious SQL commands. This can be achieved using time-based blind or UNION-based injection techniques, as demonstrated by available proof-of-concept exploits. Successful exploitation allows for unauthorized database access, sensitive data extraction, and potential modification of database records. No official patch has been confirmed, but remediation involves implementing prepared statements with parameterized queries.
Affected products
- itsourcecode Student Transcript Processing System 1.0
Timeline
- 2026-05-01: disclosed: Vulnerability details and PoC published on GitHub.
- 2026-05-26: advisory: CVE-2026-9574 published.