EUVD-2026-18338Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Impact | The CVSS 4.0 vector (AV:N/AC:L/PR:N) indicates network-accessible, low-complexity, unauthenticated attack surface with low confidentiality, integrity, and availability impact. However, this appears to underestimate the practical risk: publicly available exploit code (E:P in vector) substantially increases exploitation probability beyond baseline CVSS assumptions. SQL injection typically permits data exfiltration, authentication bypass, or privilege escalation depending on database permissions; the 'low' impact ratings may reflect database-level access controls rather than absence of exploitability. The presence of public POC code, combined with unauthenticated remote access, elevates this beyond theoretical risk-threat actors can immediately weaponize the disclosed exploit. The lack of authentication requirement (PR:N) means any internet-connected attacker can attempt exploitation without credentials. Real-world priority should exceed the CVSS 6.9 score, as SQL injection with available POC and no authentication barriers typically becomes a high-priority target within hours of disclosure. |
| Exploit ScenarioDerived | An unauthenticated remote attacker discovers the publicly disclosed exploit code and crafts a malicious HTTP request to /enrollment/index.php?view=edit&id=3&deptid=[SQL_INJECTION_PAYLOAD], injecting SQL commands such as UNION SELECT statements to extract sensitive enrollment data (student records, credentials, personal information) or ALTER TABLE commands to modify or delete records. Because the attack requires only network access and no authentication (PR:N, AC:L), the attacker can immediately execute the exploit without obtaining valid credentials, making this a high-velocity attack vector once POC is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
SQL injection in itsourcecode Online Enrollment System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the deptid parameter in /enrollment/index.php?view=edit&id=3, potentially enabling unauthorized data access, modification, or deletion. Publicly available exploit code exists, increasing real-world exploitation risk despite the moderate CVSS score of 6.9. The vulnerability affects the Parameter Handler component's SQL query construction logic.
RemediationAI
Patch availability information is not provided in the available data, but immediate remediation should prioritize input validation and parameterized queries. Developers should replace all direct SQL concatenation in the Parameter Handler component with prepared statements or parameterized queries using bound parameters for the deptid argument and all user-supplied input. Apply Web Application Firewall (WAF) rules to block SQL injection patterns in the deptid parameter as an interim measure. Contact itsourcecode.com directly for available patches or upgrade guidance, or consult the vendor advisory at https://vuldb.com/vuln/354668. Code review of all Parameter Handler functions and similar user-input processing routines is strongly recommended to identify and remediate additional injection points.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
itsourcecode Online Enrollment System is a PHP-based web application for managing student enrollment. The vulnerability stems from improper input validation in the deptid parameter passed to the Parameter Handler component, which processes user-supplied input without adequate sanitization before incorporating it into SQL queries. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, aka 'Injection') identifies the root cause: the application fails to escape or parameterize user input before using it in database queries. The affected endpoint /enrollment/index.php?view=edit&id=3 is responsible for editing enrollment records and passes the deptid argument directly to SQL statement construction without prepared statements or input validation, creating a classic SQL injection vector.
Know when Online Enrollment System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file /enrollment/index.php?view=edit&id=3 of the component Parameter Handler. This manipulation of the argument deptid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Online Enrollment System
View allSQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate paramet
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate databas
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to execute arbitrary
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate the Nam
SQL injection in itsourcecode Online Enrollment System 1.0 allows unauthenticated remote attackers to manipulate the use
Exploit-DB