CVE-2026-9574: itsourcecode Student Transcript Processing System trans.php sql injection
A flaw has been found in itsourcecode Student Transcript Processing System 1.0. This vulnerability affects unknown code of the file /admin/modules/student/trans.php. Executing a manipulation of the argument studentId/cid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
itsourcecode Student Transcript Processing System /admin/modules/student/trans.phpfrom your environment.Temporarily disable or remove the trans.php module (deny web access or remove the file from the webroot) until the code is fixed to eliminate the SQL injection vulnerability.
- Configuration
Modify /admin/modules/student/trans.php to use prepared statements/parameterized queries for all database access involving the studentId or cid parameters. Validate and sanitize these parameters (for example, enforce numeric-only IDs or strict allowlists) and avoid concatenating raw input into SQL queries.
itsourcecode Student Transcript Processing System (trans.php) studentId/cid input handling = use parameterized queries; validate/sanitize input - Compensating control
Restrict access to the admin area and to /admin/modules/student/trans.php to trusted IP addresses or internal networks using network firewall rules or web server access controls. Require strong authentication (and MFA) for administrative access.
- Compensating control
Deploy Web Application Firewall (WAF) or intrusion prevention rules to detect and block SQL injection attempts targeting the studentId/cid parameters in requests to trans.php.
- Operational
Search application and web server logs for requests to trans.php that include studentId or cid parameters to identify potential exploitation; investigate and respond to any suspicious activity.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9574?
The severity of CVE-2026-9574 is rated high at 7.3.
What type of vulnerability is CVE-2026-9574?
CVE-2026-9574 is classified as an SQL Injection vulnerability.
How do I fix CVE-2026-9574?
To fix CVE-2026-9574, validate and sanitize user input before processing it in SQL queries.
Can CVE-2026-9574 be exploited remotely?
Yes, CVE-2026-9574 can be exploited remotely by manipulating the studentId or cid parameters.
Which software is affected by CVE-2026-9574?
CVE-2026-9574 affects the itsourcecode Student Transcript Processing System version 1.0.