CVE-2026-10256: itsourcecode Content Management System save_comment.php sql injection
A vulnerability was identified in itsourcecode Content Management System 1.0. This vulnerability affects unknown code of the file /savecomment.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Content Management System 1.0from your environment.If the CMS or its comment feature is not required, uninstall the application or remove the save_comment.php file to eliminate the vulnerable functionality until a code fix is available.
- Configuration
Disable comment submission / disable or remove the save_comment.php endpoint until the vulnerable code is fixed to prevent SQL injection via the Name parameter.
itsourcecode Content Management System (save_comment.php) comment_submission = disabled - Compensating control
Deploy web application firewall rules or network firewall access controls to block SQL injection payloads targeting /save_comment.php, or restrict access to that endpoint to trusted IP addresses.
- Operational
Review web server and application logs for requests to /save_comment.php and indicators of exploitation; if compromise is detected, contain the system, rotate any potentially exposed credentials, and rebuild affected hosts as necessary.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10256?
The severity of CVE-2026-10256 is classified as medium with a score of 6.3.
How does CVE-2026-10256 affect itsourcecode Content Management System?
CVE-2026-10256 allows SQL injection through the manipulation of the 'Name' argument in the save_comment.php file.
What is the impact of exploiting CVE-2026-10256?
Exploiting CVE-2026-10256 can lead to unauthorized access to the database, potentially compromising sensitive data.
Is remote exploitation possible with CVE-2026-10256?
Yes, remote exploitation of CVE-2026-10256 is possible.
How can I mitigate CVE-2026-10256?
To mitigate CVE-2026-10256, it is recommended to sanitize and validate user inputs in the save_comment.php file.