Online Admission System EUVD-2026-92243

Exploitation requires network reachability to the application's /admin/confirm.php script and the ability to supply the schedid request parameter, which the attacker controls directly. The vendor vector claims no authentication (PR:N), but the /admin/ location suggests an administrative session may in practice be required - if the admin area enforces authentication, a valid or bypassed admin session becomes a limiting prerequisite. Realistic exposure is further limited by the product's rarity: only internet-reachable itsourcecode Online Admission System 1.0 deployments are affected, and the endpoint must be externally accessible rather than restricted to an internal network.

This is a medium-severity SQL injection (vendor CVSS 4.0 base 5.5) in itsourcecode Online Admission System 1.0 via the schedid parameter of /admin/confirm.php. Signal cross-reference: the CVSS 4.0 vector rates all impacts Low (VC:L/VI:L/VA:L) and marks exploit maturity E:P (proof-of-concept), consistent with VulDB's note that exploit code is public. There is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the public PoC indicates opportunity, not confirmed in-the-wild use. A key conflicting signal: the CVSS vector asserts PR:N (unauthenticated), yet the vulnerable endpoint lives under /admin/, which normally implies an authenticated administrative context - verify whether /admin/confirm.php is reachable without a session, as this materially changes real-world risk. Net assessment: this is a low-to-moderate real-world priority. The combination of a niche, hobby/tutorial-grade product (itsourcecode), Low technical impact ratings, and absence of KEV/EPSS corroboration outweighs the fact that a PoC exists. Patch within normal cycles; it is not an emergency.

An attacker reaches the /admin/confirm.php endpoint of an exposed Online Admission System instance and submits a crafted value for the schedid parameter, injecting SQL that the backend executes against the application database. Because a public proof-of-concept exists (CVSS E:P), an attacker can reproduce the injection to read or tamper with admission records; low CVSS complexity (AC:L) means no special timing or conditions are needed once the endpoint is reachable.