EUVD-2026-19018
GHSA-fqg9-xwv7-hgh3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in itsourcecode Online Enrollment System 1.0. This affects an unknown function of the file /sms/user/index.php?view=edit&id=10 of the component Parameter Handler. Such manipulation of the argument USERID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
AnalysisAI
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate database queries via the USERID parameter in /sms/user/index.php. The CVSS 7.3 score reflects network-accessible exploitation with low complexity requiring no privileges. Publicly available exploit code exists on GitHub, elevating immediate risk. CVSS impact ratings indicate potential for limited confidentiality, integrity, and availability compromise across the database layer.
Technical ContextAI
This vulnerability stems from CWE-89 (SQL Injection), where user-supplied input to the USERID parameter in the Parameter Handler component is incorporated into SQL queries without proper sanitization or parameterization. The affected component (/sms/user/index.php?view=edit&id=10) processes input through PHP scripts common in legacy web applications. SQL injection occurs when attackers craft malicious input that breaks out of intended query context, allowing arbitrary SQL commands to execute against the backend database. The CPE identifier (cpe:2.3:a:itsourcecode:online_enrollment_system:*:*:*:*:*:*:*:*) confirms this affects the Online Enrollment System product distributed by itsourcecode, a vendor known for open-source PHP-based educational management systems. The vulnerability exemplifies common input validation failures in applications lacking prepared statements or ORM protections.
RemediationAI
No vendor-released patch identified at time of analysis. Organizations should immediately implement input validation and parameterized queries for the USERID parameter in /sms/user/index.php. Critical mitigations include deploying prepared statements with bound parameters in all database interaction code, implementing a web application firewall with SQL injection signatures to filter malicious USERID values, restricting network access to the /sms/user/ directory using authentication controls or IP whitelisting, and conducting comprehensive code review of similar parameter handling throughout the application. As an interim measure, disable the edit functionality at /sms/user/index.php?view=edit if not operationally critical. Monitor vendor advisory channels at https://itsourcecode.com/ and https://vuldb.com/vuln/355287 for official patches. Consider migrating to actively maintained enrollment management platforms with established security track records if vendor support remains unavailable. Implement database-level least privilege principles to limit SQL injection impact scope.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today