Online Admission System CVE-2025-8338

The target must be running projectworlds Online Admission System version 1.0 with the /adminac.php endpoint network-accessible. No authentication is required (PR:N per CVSS 4.0 vector). No non-default configuration is needed - the vulnerability exists in the default application deployment. The only limiting factor is network reachability: if the application is restricted to internal networks, localhost, or a trusted IP range, the remote attack vector is neutralized. The low impact ratings (VC:L/VI:L/VA:L) suggest that database-level user privileges may constrain the attacker's reach within the database engine, but this is inferred from CVSS impact metrics rather than confirmed from the description. No special operating system, platform, or database version dependency is documented.

The CVSS 4.0 base score of 5.5 (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a network-reachable, zero-complexity, unauthenticated attack path - the most permissive possible exploitation conditions. However, all impact metrics are rated low (VC:L/VI:L/VA:L) with no subsequent-system impact, capping real-world severity. EPSS at 0.07% (22nd percentile) is strikingly low given the public PoC and trivial exploitation conditions; this is almost certainly a product-footprint signal - the application is obscure and rarely deployed in production. The vulnerability is not in CISA KEV, and no enterprise advisory has been issued. Practically, this is a high-severity flaw in a low-prevalence product: organizations running this specific application should treat it as critical, while the broader security community can deprioritize it relative to vulnerabilities in widely-deployed software. The public PoC (GitHub) is the most actionable risk signal for affected operators.

An unauthenticated attacker sends a crafted HTTP GET or POST request to /adminac.php?id=1' OR '1'='1 (or equivalent UNION-based or error-based payload) against a publicly accessible deployment of the application. The public PoC on GitHub (https://github.com/Sunhaobin318/CVE/issues/1) documents the exact injection point, reducing the skill threshold to near zero. With no authentication barrier and low attack complexity per the CVSS 4.0 vector, the attacker can enumerate database tables, extract admission records, or modify stored data in seconds using automated tools such as sqlmap.