Online Admission System CVE-2026-105184

Exploitation requires reaching the administrative script /admin/creteria.php and supplying a malicious value in the 'ID' GET/POST parameter, which is passed unsanitized into a SQL query. The CVSS vector states PR:N (no authentication), but because the file resides under /admin/, real-world exploitation most likely requires either that the admin area is deployed without access control or that the attacker already holds an administrative/authenticated session - a significant limiting factor defenders should confirm. Impact is further bounded by the product's rare deployment and by database privileges granted to the application account.

This is a medium-severity SQL injection (CVSS 4.0 base 5.5) in a niche student/hobby PHP application. The CVSS vector claims network, low-complexity, unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) with limited impact to confidentiality, integrity, and availability (VC:L/VI:L/VA:L). The E:P temporal metric and the public GitHub issue reference confirm a proof-of-concept exists, so the exploitation signal is 'publicly available exploit code exists' - NOT active exploitation. There is no CISA KEV listing and no EPSS score was provided in the input, so widespread automated exploitation cannot be confirmed from the data. CONFLICT TO VERIFY: the CVSS vector asserts PR:N (unauthenticated), yet the affected endpoint is /admin/creteria.php, which conventionally sits behind an administrative login - this is a common over-rating in auto-generated VulDB entries and should be verified against the actual application, as true unauthenticated access to an admin script would materially raise risk. On balance this is a low-real-risk issue: credible POC but a rarely deployed product and modest impact ratings, making it a patch-when-convenient item rather than an emergency, absent evidence the specific admin panel is internet-exposed without auth.

A remote attacker sends a crafted value in the 'ID' parameter to /admin/creteria.php, injecting SQL that the backend executes against the MySQL database, enabling extraction or manipulation of admission records. A public proof-of-concept is referenced in the disclosure (GitHub issue), lowering the skill needed. Realistic impact depends on whether the /admin/ path is reachable without authentication, which the CVSS vector claims but the admin path casts into doubt.