Description

A vulnerability was detected in itsourcecode Online Admission System 1.0. Affected by this issue is some unknown functionality of the file /login1.php. Performing a manipulation of the argument User results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-05T01:16:27.157Z",
  "pubdate": "2026-10-05T01:16:27.157Z",
  "executiveSummary": "The itsourcecode Online Admission System version 1.0 is susceptible to a SQL injection vulnerability within the /login1.php file. This security flaw stems from the improper sanitization of user-supplied input provided through the 'User' argument.\nA remote, unauthenticated attacker can exploit this vulnerability to manipulate backend database queries, potentially leading to unauthorized data access, modification, or deletion. The risk is significant as it facilitates unauthorized database interactions without requiring valid credentials.\nThe vulnerability is currently public, increasing the likelihood of exploitation. Affected organizations are exposed to potential data breaches, compromise of administrative credentials, and unauthorized system access. Immediate remediation is required to secure the authentication mechanism.",
  "technicalDetails": "The vulnerability exists within the authentication processing logic of /login1.php in itsourcecode Online Admission System 1.0. The application fails to adequately validate or parameterize the 'User' input argument before incorporating it directly into a SQL query executed against the backend database.\nThis flaw characterizes a classic SQL injection vulnerability, where the application allows an attacker to manipulate the structure of the database query. By injecting crafted SQL syntax into the 'User' parameter, an attacker can interfere with the query's intended logic, effectively bypassing authentication mechanisms or exfiltrating sensitive data.\nThe attack flow proceeds as follows: First, the attacker identifies the /login1.php endpoint, which processes user login attempts. Second, the attacker crafts a malicious payload containing SQL commands designed to alter the query logic, such as using single quotes, tautologies (e.g., OR 1=1), or UNION-based select statements. Third, this payload is submitted to the server via the 'User' argument in an HTTP request. Fourth, the server-side script, lacking robust input validation or prepared statements, executes the modified query against the database.\nThis allows the attacker to execute arbitrary SQL commands. Depending on the database configuration and permissions, this can lead to full database compromise, including the retrieval of administrative credentials, extraction of sensitive applicant or student data, or modification of application state. The vulnerability is remotely exploitable without authentication, as the injection point is located within the login functionality itself, which must be accessible to unauthenticated users to perform an login attempt.\nPost-exploitation impact includes the potential for total system compromise, where an attacker could gain administrative privileges by bypassing the login check or retrieving sensitive information from other tables within the database schema."
}