CVE-2026-3149
📋 TL;DR
CVE-2026-3149 is a SQL injection vulnerability in itsourcecode College Management System 1.0 that allows remote attackers to execute arbitrary SQL commands via the course_code parameter in /admin/asign-single-student-subjects.php. This affects all deployments of version 1.0 with the vulnerable file accessible. Attackers can potentially read, modify, or delete database content.
💻 Affected Systems
- itsourcecode College Management System
📦 What is this software?
College Management System by Angeljudesuarez
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive student/faculty data, grade manipulation, or administrative credential theft.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit requires admin access to reach the vulnerable endpoint, but SQL injection itself is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://itsourcecode.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries manually in the affected PHP file.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd server-side validation to sanitize the course_code parameter before SQL execution.
Edit /admin/asign-single-student-subjects.php to implement mysqli_real_escape_string() or prepared statements for course_code.
Web Application Firewall (WAF)
allDeploy a WAF to block SQL injection patterns targeting the vulnerable endpoint.
Configure WAF rules to detect and block SQL injection attempts on /admin/asign-single-student-subjects.php.
🧯 If You Can't Patch
- Restrict access to /admin/asign-single-student-subjects.php using IP whitelisting or authentication hardening.
- Implement database-level controls: use least-privilege database accounts and enable SQL logging for anomaly detection.
🔍 How to Verify
Check if Vulnerable:
Test the course_code parameter with SQL injection payloads (e.g., ' OR '1'='1) and observe database errors or unexpected behavior.Check Version:
Check the software version in the system's admin panel or configuration files.Verify Fix Applied:
Re-test with SQL injection payloads; successful fix should return proper error handling without SQL execution.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by access to /admin/asign-single-student-subjects.php
Network Indicators:
- HTTP requests to /admin/asign-single-student-subjects.php with SQL keywords in parameters
SIEM Query:
source="web_server" AND url="/admin/asign-single-student-subjects.php" AND (param="course_code" AND value MATCHES "(?i)(union|select|insert|delete|update|drop|exec)")