CVE-2026-86267: SQL Injection in itsourcecode Information System Society Membership System

The vulnerability CVE-2026-86267 affects itsourcecode Information System Society Membership System version 1.0. It is caused by improper handling of the student_id parameter in the /society/check_student.php script, leading to SQL injection. This allows remote attackers with low privileges to execute arbitrary SQL queries on the backend database. The flaw has been publicly disclosed, and exploit code is available, but there is no indication of active exploitation in the wild. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is limited to the confidentiality, integrity, and availability of the system as indicated by the CVSS vector. Since the vulnerability requires low privileges and no user interaction, it is relatively easy to exploit remotely. However, there is no evidence of widespread exploitation in the wild at this time.

No official patch or remediation guidance is currently available for this vulnerability. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to implement input validation and parameterized queries for the student_id parameter to mitigate SQL injection risks.