EUVD-2026-14738
GHSA-763j-4r42-mhxh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft HTTP request to /sms/user/index.php?view=add
-
ExploitInject SQL payload into Name parameter
-
ExecutionExecute arbitrary SQL queries
-
ImpactExtract or modify database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit SQL injection in itsourcecode Online Enrollment System 1.0 by manipulating the 'Name' parameter in /sms/user/index.php?view=add. No special configuration or victim interaction required. Default installations vulnerable. |
| Impact | This represents a high real-world risk despite the moderate CVSS base score of 7.3. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the vulnerability is remotely exploitable with low attack complexity and requires no authentication or user interaction, making it highly accessible to attackers. The Exploit Proof-of-Concept (E:P) temporal metric confirms public availability of working exploit code on GitHub (https://github.com/chuxina7-aiguo/CVE1/issues/1), which dramatically increases exploitation likelihood. The vulnerability is automatable and allows direct database manipulation (C:L/I:L/A:L), enabling credential theft, data tampering, or service disruption. Organizations running this enrollment system should treat this as a priority remediation target, especially since the affected software appears to be a niche application that may not receive timely security updates. The combination of no authentication requirement, public exploit availability, and SQL injection's well-understood attack patterns creates immediate exploitation risk. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies an internet-facing installation of Online Enrollment System 1.0 through web application fingerprinting. Using the publicly available GitHub proof-of-concept exploit, they craft a malicious HTTP request to /sms/user/index.php?view=add with SQL injection payload in the 'Name' parameter, such as injecting UNION SELECT statements to extract administrator credentials, student records, or financial information from the database. The attacker could escalate to modifying enrollment data, creating unauthorized administrative accounts, or executing operating system commands if database permissions allow, all achievable remotely without any authentication barriers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 24, 2026
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate the Name parameter in /sms/user/index.php?view=add, potentially enabling unauthorized data access, modification, or deletion. Public exploit code exists for this vulnerability, increasing risk of active exploitation. No patch is currently available.
Earlier versions of this analysis (1)
A SQL injection vulnerability exists in the itsourcecode Online Enrollment System version 1.0, specifically in the Parameter Handler component of the /sms/user/index.php file when processing the 'Name' argument. Attackers can exploit this remotely without authentication to access, modify, or delete database contents. A public proof-of-concept exploit is available on GitHub, significantly lowering the barrier to exploitation.
RemediationAI
No official vendor patch or updated version has been identified in the available references, and the Remediation Level (RL:X) in the CVSS vector indicates undefined remediation status. Organizations should immediately restrict network access to the affected /sms/user/index.php endpoint to trusted IP addresses only through firewall rules or web application firewall (WAF) policies. Implement input validation and sanitization for the 'Name' parameter, ideally by modifying the source code to use parameterized queries or prepared statements with bound parameters. Deploy a WAF with SQL injection detection signatures to block exploitation attempts. Consider migrating to alternative enrollment management software with active security support, as the lack of vendor response to this publicly disclosed vulnerability suggests inadequate security maintenance. Monitor database logs and web server access logs for suspicious SQL syntax in request parameters as an interim detection control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects itsourcecode Online Enrollment System 1.0 (CPE: cpe:2.3:a:itsourcecode:online_enrollment_system:*:*:*:*:*:*:*:*), a PHP-based web application for managing student enrollment processes. The root cause is CWE-89 (SQL Injection), where user-supplied input from the 'Name' parameter in the /sms/user/index.php?view=add endpoint is not properly sanitized before being incorporated into SQL queries. This allows attackers to inject malicious SQL commands that are executed by the database server, bypassing intended query logic and security controls. The vulnerability exists in the Parameter Handler component, suggesting improper input validation and lack of parameterized queries or prepared statements in the application's data access layer.
Know when Online Enrollment System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A weakness has been identified in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/user/index.php?view=add of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Executive ViewAI
A critical SQL injection vulnerability in the itsourcecode Online Enrollment System allows unauthenticated attackers to remotely access, modify, or delete sensitive database records. With a public exploit available and no vendor patch deployed, this vulnerability poses an immediate risk to student data, enrollment records, and system integrity.
Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the 'Name' parameter; restrict network access to the /sms/user/index.php endpoint using IP whitelisting or VPN; disable the enrollment feature if operationally feasible; apply strict input validation and parameterized queries at the application layer; enable database activity monitoring and alerting; isolate the database server on a segmented network with minimal access; implement database read-only replicas for critical operations where possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Online Enrollment System
View allSQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate paramet
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate databas
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to execute arbitrary
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate the use
SQL injection in itsourcecode Online Enrollment System 1.0 allows remote unauthenticated attackers to execute arbitrary
Exploit-DB