Online Admission System CVE-2026-108928

Exploitation requires an authenticated session with at least low-privilege access (CVSS PR:L), targeting the admin-area script /admin/sum.php and supplying a malicious value in the ID parameter, which is passed unsanitized into a SQL query. The attack is remote and needs no user interaction, but the authentication requirement and the admin-path location are the key limiting factors: an attacker must first possess valid credentials to the Online Admission System, so exposure is bounded to deployments where such accounts can be obtained or where the admin interface is reachable by the attacker.

This is a low-to-moderate real-world risk that should not be treated as an urgent priority despite the publicly disclosed exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation, but PR:L confirms the attacker must already hold valid low-privilege credentials - and the vulnerable endpoint lives under /admin/sum.php, consistent with an authenticated admin-area function rather than a pre-auth internet-facing flaw. The 4.0 Exploit Maturity is E:P (Proof-of-Concept), matching the 'POC publicly available' signal, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The impact metrics are uniformly Low (VC:L/VI:L/VA:L), which for a SQL injection likely reflects limited/partial data exposure rather than full database compromise. Signals are internally consistent (low severity, authenticated, PoC-only) - the main conflict is between the dramatic 'exploit disclosed publicly and may be used' description language and the modest 5.3 score; the score and PR:L requirement are the more reliable guide. EPSS data is missing, which would normally help quantify exploitation likelihood - verify independently if prioritizing.

An attacker who has obtained a valid low-privilege account on the Online Admission System sends a crafted value in the ID parameter to /admin/sum.php, injecting SQL that the application concatenates into a database query. Because low-complexity public proof-of-concept exploit code exists (referenced via the VulDB submission and the linked GitHub issue), an attacker can replay it with minimal effort to read or manipulate limited database contents. No victim interaction is required.