PT-2026-25707

CVE-2026-4238

Published

2026-03-16

Updated

2026-03-17

Description by

CVSS 2.0

5.8

Medium

MetricsAV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions itsourcecode College Management System version 1.0

Description A flaw exists in the processing of files within the application. Specifically, the /admin/courses.php file is susceptible to SQL injection due to improper handling of the course code parameter. This allows for remote exploitation. The details of the exploit have been publicly disclosed.

Recommendations Apply a fix to address the improper handling of the course code parameter in the /admin/courses.php file.

Exploitability

Exploit

Fix

Impacts

Researchers

Zzh01007

Vendors

Affected products

Weakness enumeration

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')