CVE-2026-10242: SQL Injection in itsourcecode CMS 1.0 /instructions.php

Technical summary

CVE-2026-10242 is a SQL injection flaw (CWE-89) resulting from improper neutralization of special elements used in SQL commands (CWE-74). The vulnerability exists in /instructions.php where the topic_id argument is insufficiently sanitized before being used in database queries. The attack requires an authenticated session (PR:L in CVSS terms) but no user interaction. Successful exploitation grants an attacker the ability to read, modify, or delete database records depending on the application's database permissions and query context.

Business impact

Organizations running itsourcecode CMS 1.0 face data confidentiality, integrity, and availability risks. Attackers with valid credentials can exfiltrate customer records, modify content or user accounts, or degrade system availability through resource-intensive queries. The combination of authentication requirement and public exploit availability increases the risk of insider threats or compromised account abuse.

Affected systems

itsourcecode Content Management System version 1.0 is affected. No patched versions or alternative products are identified in the source data; organizations should verify current deployment versions against the vendor advisory and check for upgrade paths.

Exploitability

The vulnerability carries a CVSS 3.1 score of 6.3 (Medium) with a network-accessible attack vector and low attack complexity. Exploitation requires valid user credentials, which limits opportunistic attacks but increases risk in environments with poor access controls or credential compromise. Public availability of exploit code lowers the barrier to weaponization.

Remediation

Apply vendor security updates as soon as they become available. Until patching is possible, implement network segmentation and restrict access to /instructions.php to trusted users only. Monitor database query logs for suspicious patterns, particularly those involving UNION, SELECT, or comment sequences in the topic_id parameter. Consider implementing a Web Application Firewall (WAF) rule to block common SQL injection payloads targeting this endpoint.

Patch guidance

Check the itsourcecode vendor advisory for patches addressing CVE-2026-10242. Verify the specific version numbers and test in a non-production environment before deployment. Given the authenticated attack vector, ensure that access controls to the CMS are reviewed in parallel with patching.

Detection guidance

Monitor for HTTP requests to /instructions.php containing SQL metacharacters or keywords in the topic_id parameter (e.g., single quotes, UNION, OR, --). Log all authenticated access to this endpoint and correlate with user behavior baselines. Database query logs should be analyzed for unexpected table access or queries originating from the CMS application context.

Why prioritize this

Although rated CVSS Medium, this vulnerability should be prioritized because: (1) public exploits are available, (2) the attack surface includes all authenticated users, (3) SQL injection directly threatens data confidentiality and integrity, and (4) the file /instructions.php likely handles user-controlled input in a business-critical context. Organizations should address this within 30–60 days depending on user access patterns.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects a networked, unauthenticated-exposure barrier (PR:L) balanced against full impact on confidentiality, integrity, and availability (C:L/I:L/A:L). The score does not account for the amplifying factor of public exploit availability, which raises operational risk above the base numeric score.

Frequently asked questions