EUVD-2026-92297
GHSA-3cfj-hc7w-65q7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to admin panel
-
ExploitSubmit crafted sy parameter to schoolyear.php
-
ExecutionInject SQL into backend query
-
ImpactRead/alter database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be authenticated to the administrative interface (vector shows PR:L) and to reach /admin/schoolyear.php, supplying a malicious value in the sy (school year) parameter which is concatenated into a SQL query. The primary limiting factor is that this is an admin-panel endpoint behind a login, so unauthenticated internet attackers cannot reach it directly; exploitation presupposes valid (even low-privilege) admin credentials or a separate bypass of the admin login. Affected version is itsourcecode Online Admission System 1.0; no non-default configuration or user interaction is otherwise needed. |
| Impact | This is a low-priority issue despite being a classic SQL injection (CWE-89). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores only 2.1, driven by PR:L (authentication required) and uniformly Low impact ratings. The injection point is /admin/schoolyear.php, an administrative page, so an attacker already needs valid admin-panel credentials (PR:L) to reach the vulnerable sy parameter - this substantially narrows the real-world threat. Exploitation maturity is E:P (proof-of-concept), and a public exploit reference exists (GitHub issue), but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The SQLi primitive could in principle yield higher impact (full database read/write), which conflicts with the vendor's uniformly Low VC/VI/VA ratings - VulDB conservatively rates these; a defender may wish to treat database confidentiality/integrity impact as potentially higher than the 2.1 score implies. Net: a genuine but low-urgency flaw gated behind authentication in a niche product. |
| Exploit ScenarioDerived | An attacker with (or who has obtained) low-privilege access to the admission system's admin panel navigates to /admin/schoolyear.php and injects crafted SQL through the sy parameter to read or manipulate backend database records. A public proof-of-concept is referenced via a GitHub issue, lowering the skill needed to reproduce the attack, though exploitation still requires prior authentication to the admin interface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Authenticated SQL injection in itsourcecode Online Admission System 1.0 lets a user who can reach the administrative interface inject arbitrary SQL through the 'sy' (school year) parameter of /admin/schoolyear.php, allowing read and modification of backend database contents. The attack is network-reachable but requires a valid session on the admin panel (the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so unauthenticated internet attackers cannot reach the vulnerable endpoint without first obtaining or bypassing admin credentials. Publicly available exploit code exists (a proof-of-concept has been published via the vendor-adjacent GitHub issue linked from VulDB), but there is no confirmed active exploitation (CISA KEV) and the CWE-89 flaw is assessed as low priority. EPSS data was not provided in this intelligence set.
RemediationAI
No vendor-released patch has been identified at time of analysis, so remediation must be compensating. The most effective control is to remove the administrative surface from untrusted networks: restrict /admin/ (including /admin/schoolyear.php) to trusted management IP ranges or place it behind a VPN or reverse-proxy with strong authentication, accepting the operational trade-off that remote administrators lose direct browser access to the panel. If the 'schoolyear' management function is not required, disable or delete the script outright. For code-level fixing, replace the string-concatenated query on the 'sy' parameter with parameterized/prepared statements (or at minimum strict whitelist validation that 'sy' matches an expected year pattern such as ^[0-9]{4}-[0-9]{4}$), which eliminates the injection class without functional side effects; a WAF rule matching SQL metacharacters in the 'sy' parameter can be layered on as temporary protection but is bypassable and should not be the sole control. Because exploitation requires an authenticated admin session, enforcing least-privilege admin accounts, rotating admin credentials, and alerting on database error responses or anomalous requests to /admin/schoolyear.php provide additional detection value. Monitor the vendor site at https://itsourcecode.com/ and the VulDB entry at https://vuldb.com/vuln/413463 for a fixed release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a PHP web application, itsourcecode Online Admission System 1.0, tracked by CPE cpe:2.3:a:itsourcecode:online_admission_system:*:*:*:*:*:*:*:*, which indicates the CPE does not pin a specific fixed version and effectively covers the 1.0 release line. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command, i.e. SQL injection): the 'sy' argument submitted to /admin/schoolyear.php is concatenated directly into a SQL statement without parameterization or escaping, so attacker-controlled text becomes part of the query executed by the application's database user. Because the sink sits inside the administrative surface (an admin-panel script rather than a public entry point), the practical exposure is bounded by the authentication layer in front of /admin/, which is why the independent assessment resolves the prerequisite to PR:L and keeps confidentiality, integrity and availability impacts all at Low with scope unchanged. The CVSS 4.0 record supplied by the reporter carries E:P (proof-of-concept exploit exists), reflecting the publication of exploit material rather than confirmation of live attacks.
Know when Online Admission System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remote network SQLi on an admin endpoint requiring login (PR:L), low complexity; impacts kept Low to mirror the vendor's partial C/I/A ratings.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Online Admission System
View allA vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical.php. Rated critical s
A vulnerability was found in SourceCodester Online Admission System and classified as critical. Rated critical severity
A vulnerability has been found in SourceCodester Online Admission System and classified as critical. Rated critical seve
Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter. Rated cri
A vulnerability classified as problematic has been found in SourceCodester Online Admission System. Rated medium severit
A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Rated medium
SQL injection in itsourcecode Online Admission System 1.0 lets remote attackers manipulate the ID argument processed by
Unauthenticated SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to manipulate the 'Use
A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0.php. Rate
SQL injection in projectworlds Online Admission System 1.0 exposes the `/adminac.php` endpoint to unauthenticated remote
A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Rated medium sev
A vulnerability was found in projectworlds Online Admission System 1.0. Rated medium severity (CVSS 6.9), this vulnerabi
Exploit-DB