Online Admission System EUVD-2026-14713

Remote unauthenticated attacker can exploit SQL injection in SourceCodester Online Admission System 1.0 via the 'program' parameter in /programmes.php. No authentication, user interaction, or special configuration required.

This vulnerability presents a significant real-world risk based on multiple threat indicators. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation requiring low attack complexity with no authentication or user interaction, making it easily automatable. The Exploit Maturity score (E:P) confirms a public proof-of-concept is available at https://github.com/WHOAMI-xiaoyu/CVE/blob/main/CVE_7.md, significantly increasing the likelihood of exploitation. While the impact is rated as Low across Confidentiality, Integrity, and Availability, SQL injection attacks can often be escalated beyond initial CVSS scoring through techniques like privilege escalation, secondary payload injection, or lateral movement. The combination of public exploit availability, zero authentication requirements, and network accessibility makes this a priority for organizations running the affected software, despite the moderate CVSS score. The Remediation Level (RL:X) indicates no official patch information is currently available, further elevating risk.

An unauthenticated attacker can send a crafted HTTP request to the vulnerable /programmes.php endpoint with SQL injection payloads embedded in the 'program' parameter, such as manipulating the value to include commands like ' OR '1'='1' -- or UNION SELECT statements. Because a proof-of-concept exploit is publicly available on GitHub at https://github.com/WHOAMI-xiaoyu/CVE/blob/main/CVE_7.md, even low-skilled attackers can leverage existing code to extract sensitive admission records, student information, or administrative credentials from the database. The attack requires no authentication and can be automated to scan for and exploit vulnerable instances across the internet.