CVE-2026-9525: itsourcecode Electronic Judging System edit_judge.php sql injection
A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /admin/editjudge.php. The manipulation of the argument judgeid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the /admin/ area (including /admin/edit_judge.php) to trusted management IPs or a VPN, and/or deploy a Web Application Firewall (WAF) to block SQL injection attempts targeting the judge_id parameter. If feasible, disable remote access to the admin interface until a code fix is deployed.
- Operational
Remediate the SQL injection in /admin/edit_judge.php: validate and sanitize the judge_id input, and change database access to use parameterized/prepared statements or stored procedures to eliminate concatenated SQL. Test and deploy the corrected code to production.
- Operational
Because the exploit has been publicly disclosed, review logs for suspicious activity against the application and the judge_id parameter, investigate potential compromise, and rotate any credentials or secrets that may have been exposed if signs of compromise are found.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9525?
The severity of CVE-2026-9525 is rated high with a CVSS score of 7.3.
How do I fix CVE-2026-9525?
To fix CVE-2026-9525, sanitize and validate the user input in the judge_id parameter to prevent SQL injection.
What type of vulnerability is CVE-2026-9525?
CVE-2026-9525 is an SQL injection vulnerability found in the itsourcecode Electronic Judging System.
Can CVE-2026-9525 be exploited remotely?
Yes, CVE-2026-9525 can be exploited remotely due to its exposure in the edit_judge.php file.
Which software is affected by CVE-2026-9525?
CVE-2026-9525 affects the itsourcecode Electronic Judging System version 1.0.