EUVD-2026-12421Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious SQL payload in txtsearch parameter
-
ExploitSend request to /enrollment/index.php?view=add
-
ExecutionSQL injection executes in database query
-
ImpactExtract sensitive enrollment data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated SQL injection against itsourcecode Online Enrollment System 1.0 with /enrollment/index.php?view=add endpoint accepting unsanitized txtsearch, deptname, or name parameters. |
| Impact | This vulnerability presents a significant real-world risk with a CVSS 3.1 score of 7.3 (High), characterized by network-based attacks (AV:N) requiring no authentication (PR:N) or user interaction (UI:N) with low attack complexity (AC:L). The EPSS data and KEV status were not provided, but the existence of public proof-of-concept exploits (E:P) significantly elevates the risk profile. The vulnerability allows for partial impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), meaning attackers can read sensitive data, modify records, and potentially disrupt service availability. Given the public exploit availability and the ease of exploitation, this should be treated as a high-priority remediation item for any organization using this enrollment system. |
| Exploit ScenarioDerived | An attacker can remotely exploit this vulnerability by crafting malicious SQL injection payloads in the txtsearch, deptname, or name parameters when accessing /enrollment/index.php?view=add. For example, they could inject SQL commands to bypass authentication, extract student personal information, modify grades, or delete enrollment records. Since public proof-of-concept code is available on GitHub and the attack requires no authentication or special privileges, even script kiddies can successfully exploit this vulnerability using automated tools. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate parameters in the enrollment module via the txtsearch, deptname, or name arguments. Public exploit code exists for this vulnerability, which enables attackers to read, modify, or delete database contents. No patch is currently available.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in itsourcecode Online Enrollment System 1.0 that allows remote attackers to compromise the application database through malicious input in multiple parameters. The vulnerability affects the /enrollment/index.php?view=add endpoint where the txtsearch, deptname, and name parameters are not properly sanitized before being used in database queries. Public proof-of-concept exploits are available and actively being used, making this a high-priority security issue for organizations running this enrollment system.
RemediationAI
No official patch is currently available from the vendor for this vulnerability. Organizations using itsourcecode Online Enrollment System 1.0 should immediately implement input validation and parameterized queries for all user inputs in the affected /enrollment/index.php file, particularly for the txtsearch, deptname, and name parameters. As a temporary mitigation, implement a Web Application Firewall (WAF) with SQL injection detection rules, restrict access to the enrollment system to trusted IP addresses only, and conduct a thorough security audit of all user input handling throughout the application. Consider migrating to a more secure enrollment system if the vendor does not provide timely security updates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects itsourcecode Online Enrollment System version 1.0 (CPE: cpe:2.3:a:itsourcecode:online_enrollment_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing student enrollments. The root cause is CWE-89 (SQL Injection), where user-supplied input is concatenated directly into SQL queries without proper parameterization or escaping. The affected file /enrollment/index.php accepts GET parameters through the 'view=add' functionality, and the txtsearch, deptname, and name parameters are vulnerable to SQL injection attacks, allowing attackers to manipulate database queries and potentially extract, modify, or delete sensitive enrollment data.
Know when Online Enrollment System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file /enrollment/index.php?view=add. Such manipulation of the argument txtsearch/deptname/name leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
Executive ViewAI
A critical SQL injection vulnerability in the Online Enrollment System 1.0 exposes the organization's student and enrollment database to unauthorized access and manipulation. With active public exploits available and no vendor patch released, immediate action is required to prevent data breach, compliance violations, and potential enrollment system compromise.
Implement WAF rules to sanitize and block SQL injection payloads in txtsearch, deptname, and name parameters; restrict network access to the enrollment system via IP whitelisting or VPN requirement; disable the vulnerable /enrollment/index.php?view=add endpoint if functionality permits; enable database query logging and real-time alerting for suspicious SQL patterns; apply input validation at the application layer if source code access available; consider disabling the enrollment feature entirely until patch availability or system replacement is confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in itsourcecode SQL Injection Vulnerabilities
View all 3More in Online Enrollment System
View allSQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate databas
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to execute arbitrary
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate the Nam
SQL injection in itsourcecode Online Enrollment System 1.0 allows remote unauthenticated attackers to execute arbitrary
Exploit-DB