Online Admission System CVE-2026-105253

Exploitation requires network reachability to the application's /admin/login1.php script and the ability to submit the 'User' parameter to the admin login form; no authentication, privileges, or user interaction are needed (PR:N/UI:N), consistent with a pre-authentication SQL injection in the login handler. The practical limiting factors are deployment-related rather than technical: the target must be running itsourcecode Online Admission System Project 1.0 and expose the admin login endpoint, and this is a rarely deployed sample application, so the realistic exposed population is very small.

Signals are mostly aligned toward a modest, opportunistic risk rather than an urgent enterprise-wide priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated SQL injection, which is easy to trigger, but the vulnerable-system impacts are all rated Low (VC:L/VI:L/VA:L) and there is no subsequent-system impact (SC/SI/SA:N), yielding a mid-range 6.9 score. The CVSS 4.0 Exploit Maturity metric E:P (Proof-of-Concept) matches the input's report of a publicly available exploit, so exploitability is credible but not confirmed as mass-exploited. No EPSS score and no CISA KEV listing were provided, so there is no evidence of active, widespread exploitation - the appropriate reading is that publicly available exploit code exists but no public confirmation of exploitation in the wild. The dominant risk-limiting factor is the product itself: itsourcecode Online Admission System Project 1.0 is a small, source-code-sample PHP application with negligible production footprint, so despite the pre-auth remote vector, real-world aggregate risk is low. Conflict to verify: the vendor/VulDB rate impacts as uniformly Low, yet a login-page SQL injection could plausibly allow fuller database disclosure or authentication bypass - an independent assessor may rate confidentiality higher than the source data suggests.

A remote, unauthenticated attacker locates an internet-facing deployment of the Online Admission System and sends a crafted value in the 'User' parameter of /admin/login1.php, injecting SQL into the admin login query. Because a proof-of-concept is publicly disclosed, an attacker can copy the published payload to bypass authentication or extract credentials and applicant data from the backend database. No user interaction or prior privileges are required, though the target must be reachable and running this specific niche application.