itsourcecode CMS CVE-2026-10258

Exploitation requires a valid low-privilege account on the itsourcecode CMS instance, as confirmed by the CVSS vector PR:L. The vulnerable endpoint /admin/add_sub_topic.php must be reachable over the network (AV:N), which is the case for any internet-facing deployment. No special non-default configuration is required beyond having the admin panel accessible - this is the default state of the application. Exploitation is limited by the mandatory authentication step: an attacker without any valid credential cannot reach the vulnerable parameter. Additionally, the CVSS RC:R modifier indicates the report has reasonable but not fully vendor-confirmed credibility, introducing minor uncertainty about exact behavior across all deployments.

The CVSS 3.1 base score of 6.3 reflects a network-reachable (AV:N), low-complexity (AC:L), low-privilege-required (PR:L) attack with no user interaction (UI:N) and partial impact across confidentiality, integrity, and availability (C:L/I:L/A:L). The temporal modifiers add meaningful signal: E:P (exploit proof-of-concept confirmed), RL:X (no remediation level established), and RC:R (report credibility reasonable but not confirmed by an independent vendor advisory). EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis. However, the combination of a publicly available POC on GitHub, a trivial attack complexity, and a widely redistributed open-source CMS targeting low-sophistication deployments elevates practical risk. The PR:L requirement is the primary mitigating factor - exploitation is gated on obtaining at least one valid low-privilege credential, which in small CMS deployments is often achievable through credential stuffing or default credentials.

An attacker who has obtained low-privilege credentials to the itsourcecode CMS - through credential stuffing, phishing, or default credentials - navigates to /admin/add_sub_topic.php and submits a crafted HTTP POST request with a malicious topic_id value (e.g., 1 UNION SELECT user,password,3 FROM admin--) to extract password hashes from the database. Because a public POC exists on GitHub (https://github.com/ltranquility/vuln_submit/issues/5), the attack can be replicated with minimal technical skill, reducing the barrier for exploitation once authentication is satisfied.