Online Admission System CVE-2026-105185

Exploitation targets the ID argument of /admin/examinee.php and requires the ability to reach that administrative endpoint over the network. Per the provided CVSS 4.0 vector (PR:N/UI:N), no authentication or user interaction is claimed, implying exploitation against default configurations; however, the /admin/ path location means that deployments which enforce an admin login would require valid or bypassed admin credentials, which is the key limiting factor to verify before treating this as truly pre-authentication. No non-default feature toggle is named in the description - the vulnerable code path appears reachable in the standard application.

This is a SQL injection flaw (CWE-89) in itsourcecode Online Admission System 1.0, reported by VulDB with a publicly available exploit, placing it in the 'publicly available exploit code exists' category rather than confirmed active exploitation. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation, but only Low impact across confidentiality, integrity and availability (VC:L/VI:L/VA:L), yielding a moderate 6.9 score - notably conservative for SQL injection, which typically permits full database disclosure. CONFLICTING SIGNAL: the vulnerable endpoint is /admin/examinee.php, an administrative path that normally implies prior authentication, yet the vector asserts PR:N; itsourcecode tutorial-grade applications frequently ship with absent or broken access controls on admin pages, which may reconcile this, but it should be verified against the target deployment. No EPSS score was provided in the input, and there is no CISA KEV listing, so widespread or automated exploitation is not evidenced. Net assessment: a genuine, easily exploitable injection bug with public PoC, but its real-world priority is tempered by the product's negligible enterprise footprint and the unverified authentication context - a lower practical priority than the raw CVSS or public-exploit status alone might suggest.

A remote attacker sends a crafted value in the ID parameter to /admin/examinee.php, injecting SQL that the application concatenates into a database query. Because a public exploit exists (referenced via GitHub and VulDB), an attacker can copy working payloads to enumerate or extract applicant and examinee records from the backend database. If the admin page enforces authentication in a given deployment, the attacker would first need valid or bypassed admin access.