CVE-2026-10265: itsourcecode CMS SQLi Vulnerability

CVE-2026-10265 Overview

CVE-2026-10265 is a SQL injection vulnerability in itsourcecode Content Management System 1.0. The flaw resides in the /admin/edit_topic.php script, where the topic_id parameter is passed to a database query without proper sanitization. Attackers can manipulate this argument to inject arbitrary SQL statements. The vulnerability is exploitable remotely over the network and requires low-privileged authentication. A public exploit has been disclosed through VulDB, increasing the likelihood of opportunistic attacks against exposed deployments. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Authenticated attackers can inject arbitrary SQL through the topic_id parameter in /admin/edit_topic.php, exposing the backend database to unauthorized read, modification, or deletion of records.

Affected Products

• itsourcecode Content Management System 1.0
• Deployments exposing /admin/edit_topic.php to network-accessible administrative users
• Forked or derivative codebases reusing the vulnerable edit_topic.php logic

Discovery Timeline

• 2026-06-01 - CVE-2026-10265 published to NVD
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10265

Vulnerability Analysis

The vulnerability is a server-side SQL injection in the administrative topic editing workflow of itsourcecode Content Management System 1.0. The edit_topic.php script accepts a topic_id parameter from the request and concatenates that value directly into a SQL query against the underlying database. Because user-controlled input is not parameterized, validated, or escaped, attackers can break out of the intended query context and append additional SQL clauses. This grants the attacker the ability to read arbitrary tables, alter records, or, depending on database privileges, extend access through stacked queries or file write primitives.

Root Cause

The root cause is improper neutralization of user input ([CWE-74]) before it is passed to the database driver. The topic_id parameter is treated as trusted data and inserted into the query string without prepared statements or input filtering. Any character that has syntactic meaning in SQL, such as a single quote or comment marker, is interpreted as code rather than data.

Attack Vector

Exploitation requires network access to the administrative interface and a valid low-privileged account. The attacker submits a crafted request to /admin/edit_topic.php containing a malicious payload in the topic_id parameter. The vulnerability does not require user interaction once the request is issued, and a publicly available proof of concept lowers the technical barrier to abuse.

No verified code examples are available. See the GitHub Issue Discussion and VulDB CVE-2026-10265 entry for technical reproduction details.

Detection Methods for CVE-2026-10265

Indicators of Compromise

• Web server access logs containing requests to /admin/edit_topic.php with non-numeric or SQL meta-characters in the topic_id parameter, such as single quotes, UNION, SELECT, --, or /*
• Database error messages or unusually long response times tied to requests against edit_topic.php
• Unexpected administrative session activity originating from previously unseen IP addresses or geographies

Detection Strategies

• Deploy web application firewall (WAF) rules that flag SQL injection patterns in topic_id and other administrative parameters
• Enable database query logging and alert on syntactically anomalous queries originating from the CMS application user
• Correlate authentication events with subsequent requests to /admin/edit_topic.php to detect post-login probing

Monitoring Recommendations

• Monitor outbound connections from the web server to detect data exfiltration following suspected injection attempts
• Track schema enumeration behavior such as repeated queries against information_schema tables
• Review administrative account creation, password resets, and privilege changes for evidence of post-exploitation persistence

How to Mitigate CVE-2026-10265

Immediate Actions Required

• Restrict network access to /admin/ paths using IP allowlists, VPN, or reverse proxy authentication until a fix is applied
• Audit all administrative accounts and rotate credentials, prioritizing low-privileged users who could be leveraged for the attack
• Review database logs for evidence of injection attempts against the topic_id parameter

Patch Information

No vendor patch has been published in the referenced advisories at the time of disclosure. Operators should monitor the IT Source Code project page and the VulDB Vulnerability #367545 record for updates. Until an official patch is released, source-level remediation should replace dynamic SQL with parameterized queries on the topic_id parameter and apply the same treatment to all administrative inputs.

Workarounds

• Modify edit_topic.php to cast topic_id to an integer before use, for example $topic_id = (int) $_GET['topic_id'];
• Refactor the query to use prepared statements with bound parameters via PDO or mysqli_prepare
• Place the CMS behind a WAF with managed SQL injection signatures and enable blocking mode for administrative endpoints
• Apply least-privilege principles to the database account used by the CMS, removing rights such as FILE, CREATE, and DROP where not required

# Example WAF rule (ModSecurity) blocking SQLi characters in topic_id
SecRule ARGS:topic_id "@rx [^0-9]" \
    "id:1026265,phase:2,deny,status:403,\
    msg:'CVE-2026-10265 - Non-numeric topic_id blocked'"