CVE-2026-10265: itsourcecode Content Management System edit_topic.php sql injection
A vulnerability was identified in itsourcecode Content Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/edittopic.php. Such manipulation of the argument topicid leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Content Management System /admin/edit_topic.phpfrom your environment.Remove or disable /admin/edit_topic.php (or disable web-based topic editing) until the code is fixed to eliminate the SQL injection vulnerability in the topic_id parameter.
- Compensating control
Restrict access to the /admin area (including /admin/edit_topic.php) to trusted IP addresses via firewall, reverse proxy, or web server access controls to prevent remote exploitation.
- Compensating control
Deploy a Web Application Firewall (WAF) or mod_security rules to detect and block SQL injection attempts, specifically targeting the topic_id parameter in requests to edit_topic.php.
- Operational
Review web and database logs for signs of exploitation of edit_topic.php/topic_id; if compromise is suspected, contain the system, rotate impacted credentials (database and admin accounts), and restore from known-good backups.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10265?
CVE-2026-10265 has a medium severity rating of 6.3.
How do I fix CVE-2026-10265?
To fix CVE-2026-10265, update itsourcecode Content Management System to the latest version that addresses this SQL injection vulnerability.
What type of attack is CVE-2026-10265?
CVE-2026-10265 is a SQL injection vulnerability that allows attackers to manipulate the argument 'topic_id' in the edit_topic.php file.
Can CVE-2026-10265 be exploited remotely?
Yes, CVE-2026-10265 can be exploited remotely by attackers.
What impact does CVE-2026-10265 have on the system?
CVE-2026-10265 can lead to unauthorized access to the database, which may result in data leakage or manipulation.