Itsourcecode — CraftedSignal Threat Feed

SQL Injection Vulnerability in itsourcecode Courier Management System

hello@craftedsignal.io — Fri, 01 May 2026 20:16:24 +0000

itsourcecode Courier Management System 1.0 is vulnerable to a SQL injection vulnerability. The vulnerability resides in the /edit_staff.php file and can be exploited by manipulating the ID argument. This allows a remote attacker to inject malicious SQL queries, potentially leading to unauthorized data access, modification, or deletion. The exploit is publicly available, increasing the risk of exploitation. The vulnerability was reported on May 1, 2026, and affects version 1.0 of the Courier Management System.

Attack Chain

The attacker identifies the /edit_staff.php endpoint in the Courier Management System 1.0.
The attacker crafts a malicious SQL injection payload within the ID parameter of a HTTP GET or POST request.
The attacker sends the crafted request to the /edit_staff.php endpoint.
The application fails to properly sanitize the ID parameter, allowing the SQL injection payload to be processed by the database.
The injected SQL query is executed against the database, potentially allowing the attacker to bypass authentication or authorization controls.
The attacker retrieves sensitive information from the database, such as user credentials, financial records, or other confidential data.
The attacker modifies data in the database, potentially altering application behavior or causing data corruption.
The attacker gains full control of the database server.

Impact

Successful exploitation of this SQL injection vulnerability could allow attackers to read, modify, or delete sensitive data within the Courier Management System database. This could lead to unauthorized access to customer information, financial data, and other confidential records. Given the public availability of the exploit, organizations using Courier Management System 1.0 are at a high risk of compromise.

Recommendation

Apply input validation and sanitization to the ID parameter in /edit_staff.php to prevent SQL injection (CVE-2026-7592).
Deploy the provided Sigma rule to detect potential SQL injection attempts targeting the /edit_staff.php endpoint.
Implement a web application firewall (WAF) rule to block known SQL injection payloads (CVE-2026-7592).

itsourcecode Construction Management System SQL Injection Vulnerability

hello@craftedsignal.io — Mon, 27 Apr 2026 02:16:01 +0000

A SQL injection vulnerability has been identified in itsourcecode Construction Management System version 1.0. The vulnerability resides within the /locations.php file and is triggered by manipulating the address argument. This allows a remote attacker to inject arbitrary SQL commands into the application’s database queries. This poses a significant risk as successful exploitation could lead to unauthorized data access, modification, or deletion, potentially compromising the entire system. The vulnerability has been assigned CVE-2026-7075, and a public exploit is available, increasing the likelihood of exploitation.

Attack Chain

Attacker identifies an instance of itsourcecode Construction Management System 1.0.
Attacker sends a crafted HTTP request to /locations.php with a malicious SQL payload embedded in the address parameter.
The application fails to properly sanitize the address parameter.
The unsanitized input is incorporated into an SQL query.
The database executes the attacker-controlled SQL query.
The attacker extracts sensitive data from the database.
Attacker may use the injected queries to modify or delete data.
The attacker compromises the confidentiality, integrity, and availability of the Construction Management System.

Impact

Successful exploitation of this SQL injection vulnerability (CVE-2026-7075) can lead to unauthorized access to sensitive data, including user credentials, financial records, and project details stored within the Construction Management System database. Attackers could potentially modify or delete critical data, disrupt business operations, or gain complete control over the application and its underlying infrastructure. Given the public availability of the exploit, organizations using the affected version of itsourcecode Construction Management System are at immediate risk.

Recommendation

Deploy the provided Sigma rule to detect suspicious HTTP requests to /locations.php containing potentially malicious SQL syntax in the cs-uri-query (webserver logs).
Implement input validation and sanitization for the address parameter in /locations.php to prevent SQL injection attacks.
Monitor web server logs for unusual activity, especially requests targeting /locations.php with long or complex address parameters.

itsourcecode Electronic Judging System SQL Injection Vulnerability (CVE-2026-7555)

hello@craftedsignal.io — Wed, 03 Jan 2024 18:00:00 +0000

itsourcecode Electronic Judging System 1.0 is vulnerable to SQL injection in the /intrams/login.php file. The vulnerability, identified as CVE-2026-7555, allows a remote attacker to inject malicious SQL code by manipulating the Username argument. The vulnerability was reported on 2026-05-01. Successful exploitation could lead to unauthorized access to sensitive data, modification of existing data, or even complete compromise of the database. The availability of a public exploit increases the risk of widespread exploitation. This poses a significant threat to organizations using the affected judging system, potentially disrupting operations and compromising confidential information.

Attack Chain

The attacker identifies an instance of itsourcecode Electronic Judging System 1.0 running on a target server.
The attacker crafts a malicious HTTP POST request targeting the /intrams/login.php endpoint.
Within the POST request, the attacker manipulates the Username parameter with a SQL injection payload.
The server-side application improperly processes the attacker-supplied Username value, failing to sanitize special characters.
The unsanitized Username value is incorporated into a SQL query executed against the application database.
The injected SQL code modifies the query’s intended logic, potentially bypassing authentication or extracting sensitive data.
The database server executes the modified SQL query, returning the results to the web application.
The attacker gains unauthorized access to sensitive information, such as user credentials, judging data, or other confidential application data.

Impact

Successful exploitation of this SQL injection vulnerability could allow attackers to bypass authentication, gain access to sensitive judging data, modify existing records, or potentially gain complete control of the database server. This could lead to data breaches, financial loss, reputational damage, and disruption of judging events. The lack of specific victim count or sector information in the source data makes quantifying the exact impact challenging.

Recommendation

Apply appropriate input validation and sanitization techniques to the Username parameter in /intrams/login.php to mitigate the SQL injection vulnerability.
Deploy the Sigma rule Detect Suspicious Login Attempts via SQL Injection to detect exploitation attempts targeting /intrams/login.php.
Monitor web server logs for suspicious POST requests containing unusual characters or SQL keywords in the Username parameter.
Consider implementing a web application firewall (WAF) with rules to block common SQL injection patterns.