CVE-2026-10297
SQL Injection in Fees Management System 1.0
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| itsourcecode | fees_management_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the itsourcecode Fees Management System 1.0, specifically in an unknown part of the file /manage_course.php. It is caused by improper handling of the argument ID, which allows an attacker to perform SQL injection.
SQL injection is a technique where an attacker manipulates input parameters to execute arbitrary SQL commands on the database, potentially gaining unauthorized access or modifying data.
The attack can be initiated remotely, and there are publicly available exploits that could be used to take advantage of this vulnerability.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to the database, allowing attackers to read, modify, or delete sensitive data.
Because the attack can be performed remotely, it increases the risk of data breaches without requiring physical access.
The impact includes potential loss of data integrity, confidentiality, and availability, which can disrupt normal operations and harm the organization's reputation.