Online Admission System CVE-2026-105181

Exploitation targets the 'fname' argument processed by register1.php in itsourcecode Online Admission System 1.0, with no special product feature or non-default configuration required beyond having the application deployed and reachable over the network. The CVSS vector specifies PR:L, implying a low-privilege authenticated account is needed; however, because register1.php is a registration endpoint, this privilege requirement is questionable and may in practice be unauthenticated - defenders should verify. No user interaction is required (UI:N). The primary limiting factor on real-world risk is the product's extremely narrow deployment (a hobby/tutorial codebase), not any technical exploitation barrier.

This is a low-to-moderate priority issue despite being a SQL injection flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring some privilege level, and the impact metrics are all 'Low' (VC:L/VI:L/VA:L) with no scope change - VulDB deliberately scored this conservatively at 5.3, consistent with a partial/limited-impact injection rather than full database compromise. The E:P (Proof-of-Concept) exploit maturity aligns with the stated publicly available exploit. There is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active exploitation; publicly available exploit code exists but POC availability is distinct from active in-the-wild use. Note a tension between signals: register1.php is a user-registration endpoint, which is typically pre-authentication, yet the CVSS vector specifies PR:L (authenticated) - this should be verified, as unauthenticated access would materially raise real-world risk. Overall this reads as a high-CVSS-category (SQLi/CWE-89) but low-real-risk issue, driven primarily by the obscurity and near-zero production footprint of the affected product.

An attacker reaches the Online Admission System's registration page and submits a crafted value in the 'fname' parameter of register1.php that breaks out of the intended SQL query, allowing injection of attacker-controlled SQL. Because publicly available exploit code exists, the barrier to attempting this is minimal, and given the Low impact ratings the attacker can likely read or partially manipulate limited database contents (e.g., applicant records) rather than achieve full takeover.