CVE-2026-86267: itsourcecode Information System Society Membership System check_student.php sql injection
A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/checkstudent.php. The manipulation of the argument studentid leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of itsourcecode Information System Society Membership System 1.0 that expose the /society/check_student.php endpoint are potentially affected. The vulnerable processing involves the student_id argument.
What does an attacker need to exploit it?
The issue can be exploited remotely by manipulating the student_id argument sent to check_student.php. The severity vector indicates low attack complexity, no user interaction, and that the attacker requires low privileges.
How urgent is remediation?
The issue is rated medium severity with a 6.3 score and has a publicly disclosed exploit. Public exploit availability may increase the likelihood of attempted exploitation.