CVE-2026-10811: itsourcecode Fees Management System receipt.php sql injection
A security vulnerability has been detected in itsourcecode Fees Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /receipt.php. Such manipulation of the argument efid leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Fix the SQL injection in /receipt.php by validating and sanitizing the ef_id input and using parameterized queries/prepared statements (avoid concatenating ef_id into SQL). Deploy and test the code changes to ensure the injection is eliminated.
- Compensating control
Temporarily mitigate exposure until the code fix is deployed: restrict external access to /receipt.php (use a firewall/IP allowlist), place the endpoint behind an authentication layer, or create WAF rules to block malicious payloads targeting the ef_id parameter.
- Operational
Because the vulnerability is publicly disclosed and may have been exploited, review application and database logs for suspicious requests involving ef_id and signs of data access or modification. If compromise is suspected, contain and remediate (including investigation, removal of malicious persistence), and rotate any database credentials or other secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10811?
The severity of CVE-2026-10811 is low with a score of 2.1.
How do I fix CVE-2026-10811?
To fix CVE-2026-10811, sanitize and validate the input for the ef_id parameter in receipt.php to prevent SQL injection.
What type of vulnerability is CVE-2026-10811?
CVE-2026-10811 is classified as an SQL Injection vulnerability.
Can CVE-2026-10811 be exploited remotely?
Yes, CVE-2026-10811 can be exploited remotely.
Which component is affected by CVE-2026-10811?
CVE-2026-10811 affects the /receipt.php file in the itsourcecode Fees Management System version 1.0.