Online Enrollment System CVE-2026-5534

Real-world risk is elevated despite moderate CVSS 7.3 scoring. The CVSS vector reveals critical risk factors: network attack vector (AV:N), low complexity (AC:L), and no authentication required (PR:N), meaning any internet-accessible instance is immediately exploitable by unauthenticated attackers. Publicly available exploit code on GitHub significantly lowers the barrier to exploitation, enabling even low-skill attackers to weaponize this vulnerability. While no CISA KEV listing exists indicating confirmed widespread exploitation, the combination of network exposure, zero authentication, public POC, and SQLi's well-understood attack patterns creates high probability of opportunistic exploitation. The limited impact ratings (C:L/I:L/A:L) suggest attackers may extract sensitive student/enrollment data, modify records, or cause service disruption rather than achieving full system compromise. Educational institutions using this system face compliance risks (FERPA) if student PII is exfiltrated. SSVC classification would likely recommend prioritized patching given the technical impact on data integrity and the automatable nature of SQL injection exploitation.

An unauthenticated attacker identifies an internet-exposed instance of Online Enrollment System 1.0 through Shodan or targeted reconnaissance. Using the publicly available GitHub exploit code, the attacker crafts a malicious HTTP request to /sms/user/index.php?view=edit&id=10 with a USERID parameter containing SQL injection payloads such as '1 OR 1=1-- to bypass authentication logic or UNION SELECT queries to extract sensitive enrollment data. The vulnerable Parameter Handler executes the unsanitized input directly against the database, allowing the attacker to enumerate student records, administrative credentials, or personal identifiable information. In advanced scenarios, attackers leverage time-based blind SQL injection techniques to exfiltrate data character-by-character, or execute stacked queries to modify enrollment status, drop tables, or establish persistent backdoors through database-stored procedures.