CVE-2026-9526: itsourcecode Electronic Judging System edit_team.php sql injection
A vulnerability was found in itsourcecode Electronic Judging System 1.0. This vulnerability affects unknown code of the file /admin/editteam.php. The manipulation of the argument numid results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Perform server-side validation of the num_id parameter: ensure it is an integer within expected bounds and reject or sanitize any non-numeric or out-of-range input before using it.
itsourcecode Electronic Judging System (admin/edit_team.php) num_id input validation = strict numeric validation / sanitization - Configuration
Replace any SQL string interpolation that uses num_id with parameterized queries or prepared statements (or stored procedures) so that user-supplied num_id cannot alter SQL syntax.
itsourcecode Electronic Judging System (admin/edit_team.php) database query handling = use parameterized queries / prepared statements - Compensating control
Restrict access to the /admin/ area (including edit_team.php) to trusted administrators only (for example via IP allowlist, VPN, or network segmentation) and deploy a WAF or IDS/IPS rules to detect and block SQL injection attempts targeting the num_id parameter.
- Operational
Audit logs and application state for signs of exploitation (access to edit_team.php, suspicious queries, new/modified files, webshells). Investigate and remediate any compromise found (remove backdoors, restore from clean backups) and rotate any credentials or secrets that may have been exposed. Monitor vendor advisories and apply vendor fixes when they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9526?
The severity of CVE-2026-9526 is classified as high, with a CVSS score of 7.3.
How do I fix CVE-2026-9526?
To fix CVE-2026-9526, sanitize and validate inputs in the edit_team.php file to prevent SQL injection.
What kind of vulnerability is CVE-2026-9526?
CVE-2026-9526 is a SQL injection vulnerability that affects the itsourcecode Electronic Judging System.
Can CVE-2026-9526 be exploited remotely?
Yes, the CVE-2026-9526 vulnerability can be exploited remotely by manipulating the num_id argument.
What components does CVE-2026-9526 impact?
CVE-2026-9526 impacts the /admin/edit_team.php file of the itsourcecode Electronic Judging System version 1.0.