CVE-2026-10302: itsourcecode Fees Management System manage_fee.php sql injection
A flaw has been found in itsourcecode Fees Management System 1.0. The impacted element is an unknown function of the file /managefee.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Fees Management Systemfrom your environment.If the application or the vulnerable manage_fee.php functionality is not required, uninstall or remove the affected component until a secure fix is implemented.
- Configuration
Modify /manage_fee.php to validate and sanitize the ID argument and use parameterized (prepared) SQL statements or equivalent safe database APIs to eliminate SQL injection.
itsourcecode Fees Management System (/manage_fee.php) ID parameter handling = use parameterized queries and strict input validation - Configuration
Remove or disable the /manage_fee.php endpoint (or any functionality that accepts the ID parameter) until a secure code fix is deployed.
itsourcecode Fees Management System (/manage_fee.php) endpoint accessibility = disabled until fixed - Compensating control
Place the application or the /manage_fee.php endpoint behind a WAF or restrict access to the endpoint to trusted IP addresses via network ACLs/firewall rules to block or reduce exposure to SQL injection attempts.
- Operational
Rotate database and application credentials that the vulnerable application uses and review logs for suspicious activity or indicators of exploitation prior to and after applying fixes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10302?
CVE-2026-10302 has a medium severity rating of 6.3.
How do I fix CVE-2026-10302?
To fix CVE-2026-10302, sanitize and validate all user inputs, especially the ID parameter in manage_fee.php.
What type of vulnerability is CVE-2026-10302?
CVE-2026-10302 is classified as an SQL Injection vulnerability.
Can CVE-2026-10302 be exploited remotely?
Yes, CVE-2026-10302 can be exploited remotely.
What systems are affected by CVE-2026-10302?
CVE-2026-10302 affects the itsourcecode Fees Management System version 1.0.