CVE-2026-1701 is a high severity (CVSS 7.3) SQL injection in itsourcecode School Management System 1.0. The ID argument of /enrollment/index.php is not handled safely and can be attacked remotely. The record says an exploit is public. We found no fix, so take the app off public networks.
What's affected
itsourcecode School Management System 1.0. The record names the file /enrollment/index.php and the ID argument. It also says the exploit has been disclosed publicly and may be used.
A note on the record: because the original disclosure gave contradicting product names, this CVE was first assigned to the Student Management System by mistake. The current record points to the School Management System. No patched version or vendor advisory appears in the pages we reached.
How to check if you're exposed
Search for the application in your web roots, code repositories and hosting accounts.
grep -ril "School Management System" /var/www 2>/dev/null
If you find it, check whether /enrollment/index.php can be reached from the internet, and review the web server logs for requests to that file with unusual values in the ID parameter. A request with a very long or odd ID value is a sign someone has tried it.
If it holds real student records, treat the logs and database review as urgent.
What to do now
- Confirm whether the application is deployed and who owns it.
- Remove it from public access, or restrict it to a VPN or trusted network, until it is fixed or replaced.
- Change the code to use parameterized queries for the ID value, and for every other input.
- Review logs and the database for unexpected queries or changes.
- Plan a move to a maintained system if the data is real.
Why it matters
The weaknesses are CWE-74 (Injection), CWE-89 (SQL Injection). The page takes an ID from the request and places it in a database query without neutralizing it, so an outsider can alter the query. For a school system, the data behind the page can include personal records of minors.
Parameterized queries remove the problem at its source. Sample and teaching projects are often copied into production without a security review, which is how a flaw like this ends up on a public site. CISA does not list this CVE as known exploited, though the record says an exploit is public.
Quick check
Why does the record mention the Student Management System?
The original disclosure used contradicting product names, so the CVE was first assigned to the wrong product. The current record names the School Management System.
Sources
Last reviewed: 19 October 2026.
