What is the CVSS score of CVE-2026-36234?

CVE-2026-36234 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-36234?

itsourcecode Online Student Enrollment System v1.0 contains a critical unauthenticated SQL injection vulnerability in the course enrollment module that could enable attackers to compromise the entire…

How to fix or mitigate CVE-2026-36234?

Within 24 hours: Inventory all instances of itsourcecode Online Student Enrollment System v1.0 in production and isolate affected systems from direct internet access or disable the newCourse.php endpoint. Within 7 days: Evaluate upgrade options to a patched version or alternative student enrollment system, as no vendor patch is currently available; implement input validation and parameterized queries as interim code-level mitigations if in-house development is possible. Within 30 days: Complete migration to a supported, patched platform or apply compensating network controls (WAF rules blocking 'coursename' parameter injection patterns) and conduct forensic review of database logs for unauthorized access.

PHP CVE-2026-36234

EUVD-2026-21373 CRITICAL

SQL Injection (CWE-89)

2026-04-10 mitre

GHSA-fm6c-v9mw-r38m

PHP SQLi

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 15:24 vuln.today

CVSS changed

Apr 14, 2026 - 15:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 10, 2026 - 14:45 euvd

EUVD-2026-21373

CVE Published

Apr 10, 2026 - 00:00 nvd

N/A

DescriptionCVE.org

itsourcecode Online Student Enrollment System v1.0 is vulnerable to SQL Injection in newCourse.php via the 'coursename' parameter.

AnalysisAI

SQL injection in itsourcecode Online Student Enrollment System v1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'coursename' parameter in newCourse.php, potentially enabling complete database compromise, authentication bypass, and server-side code execution. Despite a critical 9.8 CVSS score, EPSS indicates only 0.01% exploitation probability (2nd percentile), suggesting minimal observed attacker interest. Publicly available exploit code exists (GitHub POC), but no CISA KEV listing confirms active exploitation.

Technical ContextAI

This vulnerability affects a PHP-based student enrollment management application where the newCourse.php endpoint fails to properly sanitize the 'coursename' parameter before incorporating it into SQL queries. Classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), this represents a classic SQL injection flaw where user-controlled input is directly concatenated into database queries without parameterization or input validation. The vulnerability allows attackers to inject malicious SQL syntax that the database engine interprets as legitimate commands. PHP applications commonly suffer from this issue when using legacy mysql_* functions or improperly implemented mysqli/PDO queries without prepared statements. The affected product appears to be a small-scale educational management system, likely targeting academic institutions for course enrollment workflows.

RemediationAI

No vendor-released patch identified at time of analysis for itsourcecode Online Student Enrollment System v1.0. Organizations currently deploying this application should immediately implement defense-in-depth controls: deploy a web application firewall with SQL injection signature detection to filter malicious requests targeting the coursename parameter; implement network-level access restrictions limiting newCourse.php exposure to trusted administrative IP ranges only; disable or remove the vulnerable course creation functionality if not operationally critical. For development teams maintaining this codebase, refactor newCourse.php to use parameterized prepared statements (mysqli_prepare/PDO prepared statements) rather than string concatenation for all database queries, apply strict input validation accepting only alphanumeric characters and spaces for course names, and implement principle of least privilege for database service accounts to limit blast radius. Consider migrating to actively maintained enrollment management platforms with established security track records. Technical POC documentation available at https://github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student_Enrollment_System_in_newCourse.php_sql_injection.pdf provides implementation details for testing defensive controls.