Online Admission System SQL Injection and Injection Flaws

Unauthenticated SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to manipulate the 'User' login argument in /login1.php to execute arbitrary SQL queries against the underlying database. Publicly available exploit code exists, but the product is a niche educational PHP application with limited real-world deployment, and the assessed impact is Low (VC:L/VI:L/VA:L), indicating partial rather than full database compromise. Signals are mixed and lean toward low-to-moderate real-world risk despite the network-facing, unauthenticated nature of the flaw.

SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to inject arbitrary SQL through the 'ID' parameter of /admin/creteria.php, potentially reading or modifying the underlying database. The vulnerable script is located under the /admin/ path, so although the published CVSS 4.0 vector indicates PR:N (no authentication), real-world exploitation most likely requires either an admin area deployed without access control or an existing administrative session. Publicly available exploit code exists and the flaw was disclosed publicly, but there is no CISA KEV entry and no observed evidence of active exploitation; assessed severity is medium (CVSS 4.0 base 5.5).

SQL injection in itsourcecode Online Admission System 1.0 lets remote attackers inject arbitrary SQL through the schedid request parameter handled by /admin/confirm.php, potentially reading or altering admission-related database records. The vendor's CVSS 4.0 vector (5.5, E:P) claims no authentication is required (PR:N), though the /admin/ path suggests an administrative session may in practice be needed; our independent assessment scores it CVSS 3.1 5.6-adjacent at PR:L with limited confidentiality and integrity impact. Publicly available exploit code exists (a GitHub issue demonstrating the flaw), but there is no indication of confirmed active exploitation and no CISA KEV listing; exposure is limited to internet-reachable deployments of this relatively obscure PHP application.

SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to read or alter database contents via the fname argument processed by register1.php. The flaw is tracked as CVE-2026-105181 (CWE-89) with a CVSS 4.0 base score of 5.3 and publicly available exploit code; there is no CISA KEV confirmation of active exploitation. The CVSS vector indicates PR:L, but because register1.php is a registration endpoint, the required privilege level is questionable and may in practice be unauthenticated - defenders should verify.