CVE-2026-5553

Vulnerability

Overview

A SQL injection vulnerability exists in itsourcecode Online Cellphone System version 1.0, specifically in the /cp/available.php file. The root cause is insufficient validation of the Name parameter, which is passed via multipart POST data. User-supplied input is directly concatenated into SQL queries without proper sanitization or parameterization, allowing an attacker to inject arbitrary SQL commands [1].

Exploitation

The attack can be launched remotely without requiring any authentication or prior authorization. The parameter MULTIPART name ((custom) POST) is the injection point is exploitable using techniques such as boolean-based blind SQL injection. A proof-of-concept payload has been publicly disclosed, lowering the barrier for exploitation [1].

Impact

Successful exploitation enables an attacker to gain unauthorized access to the underlying database. This can lead to sensitive data leakage, data modification or deletion, and potentially full system compromise. The impact extends to business continuity, as the attacker may disrupt services or manipulate critical information [1].

Mitigation

As of the publication date, no official patch has been released by the vendor. The project is available from itsourcecode.com [2]. Users should apply input validation and use prepared statements with parameterized queries to remediate the vulnerability. Given the public availability of exploit details, immediate action is recommended.