CVE-2026-10297: itsourcecode Fees Management System manage_course.php sql injection
A vulnerability was identified in itsourcecode Fees Management System 1.0. This affects an unknown part of the file /managecourse.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Fees Management System 1.0from your environment.If the component is not required, uninstall or take the application (or the manage_course.php endpoint) offline until a secure fix is implemented.
- Configuration
Modify manage_course.php to validate the ID input (e.g., enforce integer type/whitelisting) and use parameterized queries/prepared statements for all database access to eliminate SQL injection.
manage_course.php (itsourcecode Fees Management System 1.0) ID parameter handling = validate and use parameterized queries / prepared statements - Compensating control
Restrict access to /manage_course.php (and the management interface) to trusted IPs only via firewall, web server access controls, or place the application behind a WAF; block public access until the issue is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10297?
The severity of CVE-2026-10297 is medium with a CVSS score of 6.3.
How do I fix CVE-2026-10297?
To fix CVE-2026-10297, sanitize and validate input when handling the ID argument to prevent SQL injection.
What kind of attack is possible due to CVE-2026-10297?
CVE-2026-10297 allows for SQL injection attacks that can be initiated remotely.
Which file is affected by CVE-2026-10297?
The vulnerable file in CVE-2026-10297 is /manage_course.php.
Is there a public exploit available for CVE-2026-10297?
Yes, exploits for CVE-2026-10297 are publicly available and could be used in attacks.