EUVD-2026-92246
GHSA-fqp2-g4vw-r3c8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged account
-
ExploitSubmit crafted schedid to /new.php
-
ExecutionInject SQL via unsanitized parameter
-
ImpactRead or modify database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid low-privileged authenticated session in the itsourcecode Online Admission System (CVSS PR:L), after which the attacker manipulates the schedid argument on /new.php to inject SQL. There is no user-interaction requirement (UI:N) and no non-default configuration needed beyond a running, authenticated instance. The authentication prerequisite is the primary limiting factor; impact is bounded (partial confidentiality, integrity, and availability only), so the injection does not inherently grant full database or host control from available data. |
| Impact | This is a moderate-severity, low-priority issue despite being remotely exploitable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-based, low-complexity exploitation, but PR:L means an attacker must already hold a valid low-privileged account, which meaningfully constrains real-world risk. Impacts are only partial across the board (VC:L/VI:L/VA:L), consistent with a bounded SQL injection rather than full database compromise or RCE. A public exploit exists (E:P, GitHub issue reference), which raises opportunistic risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the signals point to proof-of-concept availability rather than operational attacks. The only intelligence source is VulDB; no independent vendor advisory or NVD enrichment is present, so affected-version and patch data are unverified. Net: a real but lower-tier item - prioritize patching only after internet-facing, unauthenticated-critical issues. |
| Exploit ScenarioDerived | An attacker who has obtained or registered a low-privileged account in the Online Admission System sends a crafted request to /new.php with a malicious schedid parameter, injecting SQL to read or tamper with records in the backing database. A public exploit for this exact parameter has been published (GitHub), lowering the skill required to reproduce the attack. The network attack vector with low complexity means it can be performed remotely once authenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
SQL injection in itsourcecode Online Admission System 1.0 lets an authenticated, low-privileged user manipulate the schedid argument on /new.php so that attacker-controlled input is interpreted as part of a backend SQL statement, giving limited confidentiality, integrity and availability impact with no user interaction required. The issue is remotely reachable and publicly available exploit code exists (a public GitHub issue demonstrates the vector), but CISA KEV does not list it and no vendor-released patch was identified in the available data, so this remains a moderate-severity, low-priority issue for most deployments. Exposure is bounded by the authentication prerequisite: an attacker needs a valid low-privileged session in the application, and from the reported vector the injection does not inherently yield full database or host control.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation must start with compensating controls until a fix is published on the vendor site (https://itsourcecode.com/) or an advisory appears in the VulDB entries (https://vuldb.com/vuln/413423). Because exploitation requires a valid low-privileged session, the highest-value immediate control is to restrict who can reach /new.php: enforce strong authentication and remove or downgrade access to the schedule/admission creation functions for untrusted or self-registered accounts, accepting that this may block legitimate applicant or staff workflows that depend on that page. Second, fix the root cause in code by validating schedid as a strict integer (allowlist/cast) and rewriting the query in /new.php to use parameterized prepared statements with bound parameters; this is safe to apply immediately but requires source change management and regression testing of the admission flow. Third, until the code fix is deployed, place a WAF or reverse-proxy rule in front of /new.php that blocks SQL metacharacter patterns and known injection payloads, understanding the trade-off of false positives on legitimate form submissions. Fourth, run the application database account with least privilege (no FILE, no DROP/ALTER, no cross-schema access) and enable query/error logging plus alerting on anomalous schedid values, which limits the blast radius of a successful injection but does not by itself prevent data disclosure. Note that the public exploit reference at https://github.com/ltranquility/submit/issues/27 makes unauthenticated internet exposure of this application especially unwise; network-level restriction to trusted clients is a reasonable temporary measure if the portal does not need to be publicly reachable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the PHP web application itsourcecode Online Admission System, an admissions/enrollment portal whose /new.php script handles a schedid (schedule identifier) argument and passes it into a SQL query without adequate neutralization of special elements. That maps directly to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), i.e. classic SQL injection via string concatenation instead of prepared statements with bound parameters. The CPE record cpe:2.3:a:itsourcecode:online_admission_system:*:*:*:*:*:*:*:* uses a version wildcard, and the reporting source ties the flaw to version 1.0. The supplied CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P) indicates network reachability, low attack complexity, no non-default configuration requirement, a low-privilege prerequisite, no user interaction, and a publicly demonstrated proof-of-concept (E:P), while impact is confined to the vulnerable component with low-level loss of confidentiality, integrity and availability. Our independent assessment normalizes this to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, which is consistent with a bounded injection rather than an unauthenticated, fully compromising flaw. Because the application is PHP and likely backed by MySQL/MariaDB, the practical risk class is data disclosure or modification of admission/schedule records reachable by the injected query, with possible error-based or boolean/union techniques depending on query construction and database error handling.
Know when Online Admission System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable, low-complexity SQL injection but requires a low-privileged authenticated account (PR:L); impacts kept partial (C/I/A:L) reflecting a bounded injection, not full DB takeover.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in itsourcecode Online Admission System 1.0. This impacts an unknown function of the file /new.php. Executing a manipulation of the argument schedid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Online Admission System
View allA vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical.php. Rated critical s
A vulnerability was found in SourceCodester Online Admission System and classified as critical. Rated critical severity
A vulnerability has been found in SourceCodester Online Admission System and classified as critical. Rated critical seve
Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter. Rated cri
A vulnerability classified as problematic has been found in SourceCodester Online Admission System. Rated medium severit
A vulnerability, which was classified as problematic, was found in SourceCodester Online Admission System. Rated medium
SQL injection in itsourcecode Online Admission System 1.0 lets remote attackers manipulate the ID argument processed by
Unauthenticated SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to manipulate the 'Use
A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0.php. Rate
SQL injection in projectworlds Online Admission System 1.0 exposes the `/adminac.php` endpoint to unauthenticated remote
A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Rated medium sev
A vulnerability was found in projectworlds Online Admission System 1.0. Rated medium severity (CVSS 6.9), this vulnerabi
Exploit-DB