What is the CVSS score of CVE-2026-36235?

CVE-2026-36235 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-36235?

Within 24 hours: identify all instances of itsourcecode Online Student Enrollment System v1.0 in production and isolate or restrict network access to scheduleSubList.php. Within 7 days: implement Web Application Firewall (WAF) rules to block SQL injection patterns in the 'subjcode' parameter, and prepare application backup/recovery procedures. Within 30 days: contact vendor for patch availability; evaluate replacement or upgrade options; conduct database audit for unauthorized access or data exfiltration.

PHP CVE-2026-36235

EUVD-2026-21374 CRITICAL

SQL Injection (CWE-89)

2026-04-10 mitre

GHSA-r9rh-xw3r-r4x2

PHP SQLi

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 15:24 vuln.today

CVSS changed

Apr 14, 2026 - 15:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 10, 2026 - 14:45 euvd

EUVD-2026-21374

CVE Published

Apr 10, 2026 - 00:00 nvd

N/A

DescriptionCVE.org

A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'subjcode' parameter is directly embedded into the SQL query via string interpolation without any sanitization or validation.

AnalysisAI

SQL injection in itsourcecode Online Student Enrollment System v1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands through the 'subjcode' parameter in scheduleSubList.php, achieving full database compromise with potential for complete system control. CVSS 9.8 (Critical) reflects network-accessible exploitation requiring no privileges or user interaction. EPSS score of 0.01% (2nd percentile) indicates minimal observed exploitation activity, and no CISA KEV listing exists, suggesting limited real-world targeting despite the theoretical severity. Public proof-of-concept documentation exists on GitHub, lowering the technical barrier for exploitation.

Technical ContextAI

This vulnerability represents a classic first-order SQL injection (CWE-89) in a PHP-based student enrollment management application. The scheduleSubList.php endpoint accepts the 'subjcode' parameter and directly concatenates it into SQL query strings without parameterized statements, prepared statements, or input sanitization. String interpolation in PHP (using variable expansion within double-quoted strings or concatenation operators) creates SQL queries where user-controlled data is interpreted as SQL code rather than data. When exploited, attackers can append malicious SQL syntax to break out of the intended query logic, enabling UNION-based data exfiltration, boolean-based blind enumeration, time-based inference attacks, or stacked queries for data manipulation. The vulnerability affects database confidentiality, integrity, and availability according to the CVSS impact metrics (C:H/I:H/A:H), meaning attackers can read sensitive student/administrative data, modify enrollment records or credentials, and potentially drop tables or execute operating system commands if the database user has elevated privileges and the underlying DBMS supports extended procedures.

RemediationAI

Organizations must immediately implement parameterized SQL queries using PHP PDO (PHP Data Objects) or MySQLi prepared statements to eliminate SQL injection attack surface in scheduleSubList.php. The vulnerable code pattern should be refactored to bind the 'subjcode' parameter as a typed variable rather than concatenating it into query strings. As the vendor has not released an official patched version according to available data, administrators should apply manual code remediation or implement compensating controls. Short-term mitigations include: deploying web application firewall (WAF) rules to block SQL metacharacters in the subjcode parameter, restricting database user permissions to read-only for the application service account (preventing DELETE/UPDATE/DROP operations), implementing network segmentation to limit database server exposure, and enabling comprehensive SQL query logging for forensic detection. Public exploit documentation is available at https://github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student_Enrollment_System_in_scheduleSubList.php_sql_injection.pdf providing technical details for validation testing. If source code modification is not feasible, consider migrating to actively maintained enrollment system alternatives with secure development practices and vendor support. Refer to NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-36235 for ongoing updates.