CVE-2026-9528: itsourcecode Electronic Judging System delete_judge.php sql injection
A vulnerability was identified in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /admin/deletejudge.php. Such manipulation of the argument judgeid leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Electronic Judging System 1.0from your environment.If the application or the vulnerable admin functionality is not required, uninstall or remove the Electronic Judging System to eliminate the vulnerability.
- Configuration
Validate and sanitize the judge_id parameter server-side and use parameterized queries / prepared statements or proper escaping for all database queries in /admin/delete_judge.php to prevent SQL injection.
itsourcecode Electronic Judging System 1.0 (/admin/delete_judge.php) judge_id input handling = validate, sanitize, and parameterize input - Compensating control
Restrict remote access to /admin/delete_judge.php (and the admin area) using firewall rules or network ACLs to trusted IPs or internal networks only; require strong authentication and limit exposure to the internet.
- Operational
Review web server and application logs for suspicious requests to /admin/delete_judge.php and signs of SQL injection exploitation; perform incident response as appropriate.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9528?
The severity of CVE-2026-9528 is high, with a score of 7.3.
How does CVE-2026-9528 affect the itsourcecode Electronic Judging System?
CVE-2026-9528 allows for SQL injection through the deletion of judges using an unsafe parameter in delete_judge.php.
Can CVE-2026-9528 be exploited remotely?
Yes, CVE-2026-9528 can be exploited remotely due to the nature of the SQL injection vulnerability.
How can I fix CVE-2026-9528 in the itsourcecode Electronic Judging System?
To fix CVE-2026-9528, validate and sanitize the judge_id input to prevent SQL injection.
Is there a public exploit available for CVE-2026-9528?
Yes, a publicly available exploit exists for CVE-2026-9528 that can be utilized to execute the SQL injection.