CVE-2026-10808: itsourcecode Fees Management System manage_student.php sql injection
A vulnerability was identified in itsourcecode Fees Management System 1.0. This affects an unknown function of the file /managestudent.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Fees Management System (manage_student.php)from your environment.If the manage_student.php functionality is not required, disable or remove the file/component from the webserver to eliminate the vulnerable endpoint.
- Configuration
Modify the code in /manage_student.php to treat the ID parameter safely: validate or cast inputs (e.g., allow only expected numeric IDs) and use parameterized/prepared SQL statements (or equivalent ORM parameterization) instead of interpolating the ID into queries to prevent SQL injection.
itsourcecode Fees Management System (manage_student.php) ID parameter handling = use parameterized/prepared statements and validate/sanitize numeric ID input - Compensating control
Until the code is fixed, restrict access to /manage_student.php (for example via network ACLs, firewall rules, IP allowlisting) or place the application behind a Web Application Firewall configured to block SQL injection payloads to reduce risk of remote exploitation.
- Operational
Search application and database logs for signs of exploitation of the ID parameter (unexpected queries, data changes, or suspicious access), and if compromise is suspected, contain and remediate (for example, rotate any exposed credentials, restore from known-good backups, and follow incident response procedures).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10808?
The severity of CVE-2026-10808 is classified as low with a score of 2.1.
What systems are affected by CVE-2026-10808?
CVE-2026-10808 affects version 1.0 of the itsourcecode Fees Management System.
How does CVE-2026-10808 affect the Fees Management System?
CVE-2026-10808 allows for SQL injection through manipulation of the ID argument in the /manage_student.php file.
How can I mitigate CVE-2026-10808?
To mitigate CVE-2026-10808, input validation and parameterized queries should be implemented to prevent SQL injection.
Is there an available exploit for CVE-2026-10808?
Yes, a publicly available exploit for CVE-2026-10808 exists and could potentially be used for exploitation.