This vulnerability involves SQL injection in the itsourcecode CMS 1.0 specifically via the topic_id parameter in the /admin/update_ss_img.php script. An attacker can remotely exploit this flaw by sending crafted input to the topic_id argument, which is not properly sanitized, resulting in execution of arbitrary SQL commands on the backend database. The vulnerability has been assigned CVE-2026-10257 and has a CVSS 4.0 score of 5.3, indicating a medium level of severity. Exploit code is publicly available, increasing the risk of exploitation. No vendor patch or official remediation is currently documented.

Successful exploitation of this SQL injection vulnerability can allow an attacker to manipulate backend database queries. This may lead to unauthorized data disclosure, data modification, or other impacts depending on the database and application context. The vulnerability is remotely exploitable without user interaction and requires low attack complexity. However, the overall impact is rated medium due to limited privileges required and partial impact on confidentiality, integrity, and availability.

No official patch or remediation guidance is currently available from the vendor. Users of itsourcecode CMS 1.0 should monitor the vendor's advisory channels for updates. Until a fix is released, consider restricting access to the /admin/update_ss_img.php endpoint to trusted users only and implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the topic_id parameter. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.