This vulnerability in itsourcecode Electronic Judging System 1.0 involves SQL injection via the fname parameter in the /intrams/admin/add_judges.php file. An attacker can remotely manipulate this parameter to inject SQL commands, potentially compromising the database. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. The vulnerability was publicly disclosed on 2026-07-14, but no patch or official remediation has been provided.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and validate or sanitize user inputs to the fname parameter to mitigate SQL injection risks.