Online Admission System CVE-2026-104606

Exploitation requires reaching the confirm.php endpoint of an itsourcecode Online Admission System Project 1.0 instance and supplying a malicious value in the 'ID' parameter, which is passed into a SQL query without sanitization. Per the CVSS 4.0 vector (PR:L), a low-privilege authenticated session is required, which limits fully anonymous exploitation; no user interaction is needed (UI:N). Practical risk is further constrained by the product's limited deployment - it is a tutorial/sample application rather than widely deployed enterprise software - and by the need for the vulnerable instance to be network-reachable.

This is a classic SQL injection (CWE-89) in a small open-source PHP application, reported by VulDB, and the real-world risk is LOW-to-MODERATE despite public exploit availability. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires low-privilege authentication (PR:L), and the impact is rated only partial across confidentiality, integrity and availability (VC:L/VI:L/VA:L), yielding a modest 5.3 score. The 'E:P' in the vector plus the GitHub issue reference confirm publicly available exploit code exists, but this is NOT the same as active exploitation: the CVE is NOT listed in CISA KEV, and no EPSS score was provided in the input, so widespread or automated exploitation cannot be inferred. The dominant risk-limiting factor is the product itself - itsourcecode projects are tutorial/sample applications with negligible enterprise deployment, so even a public PoC is unlikely to translate into broad real-world attacks. Signals are internally consistent (no CVSS-vs-description conflict), but note that PoC availability and the full database impact typical of SQLi could justify a higher impact rating than the vendor's L/L/L; treat the 5.3 as a floor rather than a ceiling.

An attacker with a low-privilege account on an exposed Online Admission System instance sends an HTTP request to confirm.php with a crafted 'ID' parameter, injecting SQL to read or alter admission database records. Public exploit code is already available via a GitHub issue, lowering the skill barrier, and the low attack complexity means no special timing or environmental conditions are needed.