CVE-2026-10258: itsourcecode Content Management System add_sub_topic.php sql injection
A weakness has been identified in itsourcecode Content Management System 1.0. Impacted is an unknown function of the file /admin/addsubtopic.php. This manipulation of the argument topicid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify /admin/add_sub_topic.php to validate and sanitize the topic_id parameter (e.g., enforce numeric-only if applicable) and use parameterized queries / prepared statements or proper escaping for all database queries to eliminate SQL injection.
itsourcecode Content Management System (admin/add_sub_topic.php) topic_id input handling = validate as integer and use parameterized queries / prepared statements - Compensating control
Restrict access to the /admin/* directory (including /admin/add_sub_topic.php) to trusted IP addresses, place the admin interface behind a VPN or require additional authentication, and/or deploy a WAF rule to block malicious SQL injection payloads until code is fixed.
- Operational
Review web and database logs for signs of exploitation; if compromise is suspected, rotate database credentials and any potentially exposed credentials and restore affected components from known-good backups.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10258?
The severity of CVE-2026-10258 is medium with a CVSS score of 6.3.
How does CVE-2026-10258 affect itsourcecode Content Management System?
CVE-2026-10258 allows for SQL injection through manipulation of the topic_id argument in the /admin/add_sub_topic.php file.
Can CVE-2026-10258 be exploited remotely?
Yes, CVE-2026-10258 can be exploited remotely.
What steps can be taken to mitigate CVE-2026-10258?
To mitigate CVE-2026-10258, validate and sanitize input to the topic_id parameter to prevent SQL injection.
What is the impact of a successful exploit of CVE-2026-10258?
A successful exploit of CVE-2026-10258 could potentially lead to unauthorized access to the database and manipulation of data.