CVE-2026-3410 is a high severity (CVSS 7.3) SQL injection in itsourcecode Society Management System 1.0, in the student ID check page. The record says an exploit is public. No fix is listed, so remove the app from public networks or rewrite the query with bound parameters.
What's affected
The record lists the Society Management System, version 1.0, from itsourcecode. The affected file is /admin/check_studid.php, and the argument called student_id is where the injection happens.
No patched version appears in the record. Its references are a GitHub issue, the itsourcecode home page and VulDB entries, none of which I could confirm as a vendor fix. Assume version 1.0 is vulnerable.
How to check if you're exposed
Search your servers and repositories for this application. Sites like itsourcecode distribute free source code for student projects, and copies sometimes end up on test servers that are open to the internet.
If you find it, request the path /admin/check_studid.php in your access logs and see who has called it. The vector in the record shows network access with no privileges needed, so the page can be reached without logging in.
Check the database for new or changed accounts.
What to do now
- Search for the Society Management System in web roots and code repositories.
- Take any public copy offline or restrict it to a trusted address range.
- Change the query in the affected file to use prepared statements.
- Check database tables for unexpected rows or users.
- If real member data is stored, plan a move to a maintained platform.
Why it matters
The record lists CWE-89 (SQL injection) and CWE-74 (injection). A value from the request is placed into a SQL statement as text, so the database can read part of it as an instruction.
Source code from free project sites is meant for learning, and security is rarely part of the exercise. A system that stores real student or member records deserves more care than that. The record does not mark the CVE as exploited, and it is not on the CISA KEV list, though it does state that the exploit has been disclosed.
Quick check
Is a login enough to protect the page?
The record's vector says no privileges are needed, so the page can be reached without one. Do not rely on the login screen as the only guard.
Sources
Last reviewed: 19 October 2026.
