EUVD-2026-92247
GHSA-7rgp-c329-279g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged admin-panel session
-
ExploitSubmit crafted ID parameter to /admin/key.php
-
ExecutionTrigger SQL injection in backend query
-
ImpactRead or alter limited database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with at least low-level privileges (PR:L) sufficient to reach the administrative endpoint /admin/key.php, and the attacker must supply a manipulated ID parameter to that script. There is no default-unauthenticated path per the CVSS vector; the admin-panel location and required authentication are the primary limiting factors, confining realistic risk to insiders or attackers who have already obtained valid low-privilege credentials. |
| Impact | This is a low-priority, low-real-risk issue despite being a remotely reachable SQL injection (CWE-89). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) and resulting base score of 2.1 agree with the description: network-reachable and low-complexity, but requiring low privileges (PR:L) and yielding only low confidentiality, integrity, and availability impact with no scope change. The E:P value marks the exploit as proof-of-concept, consistent with the publicly available GitHub exploit; there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The signals are internally consistent - a VulDB-reported, PoC-stage flaw in an obscure PHP application - rather than conflicting. The PR:L requirement is notable: the vulnerable endpoint lives under /admin/ (/admin/key.php), implying the attacker must already hold at least a low-privileged authenticated session, which further limits practical impact. No EPSS probability was supplied, so widespread-scanning likelihood cannot be quantified from the data. |
| Exploit ScenarioDerived | A low-privileged authenticated user of the Online Admission System sends a crafted value in the ID parameter to /admin/key.php, injecting SQL that the backend executes against the database. Public proof-of-concept exploit code exists (GitHub), but the flaw yields only limited data disclosure and modification rather than full compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
SQL injection in itsourcecode Online Admission System 1.0 allows an attacker who already holds a valid low-privilege session to manipulate the ID parameter of /admin/key.php and inject arbitrary SQL into the backend database. Exploitation is remote but gated behind authentication and access to the administrative endpoint, so it is a low-priority, low-real-risk issue per our assessment; the practical exposure is confined to insiders or attackers who have already obtained credentials. Publicly available exploit code exists, no public exploit has been confirmed as actively exploited, and no CISA KEV entry is associated with this CVE.
RemediationAI
No vendor-released patch was identified at time of analysis, and none of the supplied references (VulDB entries, the GitHub issue, or the itsourcecode.com site) point to a fixed version, so the code-level fix must be applied by the integrator: rewrite /admin/key.php so the ID argument is passed through a parameterized/prepared statement or strictly validated against an integer allowlist. Until that is done, the most effective compensating control is to remove the exposed administrative surface - restrict /admin/key.php to trusted management networks or VPN-only access via web server ACLs and .htaccess/IP allowlists, accepting that this breaks remote administration from untrusted locations. Enforce strong, unique credentials and least-privilege roles for the admin panel to reduce the chance of the low-privilege session the attack requires, and note that this only raises the bar rather than removing the injection. A WAF rule targeting SQL metacharacters in the ID parameter on /admin/key.php provides interim detection and blocking but is bypassable and can generate false positives on legitimate administrative traffic; additionally, run the application's database account with minimal privileges and disable verbose SQL error output to limit information leakage from failed injections.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The target is a PHP-based web application (itsourcecode Online Admission System, CPE cpe:2.3:a:itsourcecode:online_admission_system:*:*:*:*:*:*:*:* - the CPE uses a wildcard version, so all 1.x builds should be treated as suspect) whose administrative script /admin/key.php accepts an ID argument that is concatenated into a SQL statement without parameterization. This is the classic CWE-89 improper neutralization of special elements used in an SQL command, where user-controlled input reaches the query interpreter instead of being bound as a typed parameter. The vulnerability is reported by VulDB and reproduced publicly through a GitHub issue (ltranquility/submit#28); the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, low confidentiality/integrity/availability impact, E:P) aligns with our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, meaning the SQL injection is genuine but produces limited, non-scoped impact once an authenticated low-privilege foothold exists.
Know when Online Admission System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Endpoint sits under /admin/ and requires an authenticated low-privilege session (PR:L); network-reachable and low-complexity (AV:N/AC:L), with limited database read/write giving low C/I/A.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in itsourcecode Online Admission System 1.0. Affected is an unknown function of the file /admin/key.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Online Admission System
View allA vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical.php. Rated critical s
A vulnerability was found in SourceCodester Online Admission System and classified as critical. Rated critical severity
A vulnerability has been found in SourceCodester Online Admission System and classified as critical. Rated critical seve
Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter. Rated cri
A vulnerability classified as problematic has been found in SourceCodester Online Admission System. Rated medium severit
A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Rated medium
SQL injection in itsourcecode Online Admission System 1.0 lets remote attackers manipulate the ID argument processed by
Unauthenticated SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to manipulate the 'Use
A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0.php. Rate
SQL injection in projectworlds Online Admission System 1.0 exposes the `/adminac.php` endpoint to unauthenticated remote
A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Rated medium sev
A vulnerability was found in projectworlds Online Admission System 1.0. Rated medium severity (CVSS 6.9), this vulnerabi
Exploit-DB