Description

A vulnerability has been found in itsourcecode Online Admission System 1.0. Affected is an unknown function of the file /admin/key.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-05T04:17:07.887Z",
  "pubdate": "2026-10-05T04:17:07.887Z",
  "executiveSummary": "A SQL Injection (SQLi) vulnerability has been identified in the itsourcecode Online Admission System version 1.0. The vulnerability exists within the /admin/key.php file, where the ID argument is inadequately sanitized before being processed by the backend database.\nThis flaw allows remote, unauthenticated attackers to manipulate SQL queries, potentially leading to unauthorized data extraction, modification, or deletion within the underlying database. The risk is considered critical, as the exploit is publicly disclosed, lowering the barrier for entry for malicious actors.\nSuccessful exploitation grants an attacker the ability to bypass application-level authentication, exfiltrate sensitive administrative or applicant data, and potentially compromise the integrity of the entire database management system. Given the nature of an admission system, this could lead to significant privacy breaches and unauthorized access to protected records.",
  "technicalDetails": "The vulnerability originates from improper neutralization of special elements used in an SQL command within the /admin/key.php script. The application fails to utilize parameterized queries or prepared statements when handling user-supplied input through the ID parameter.\nThe attack flow begins when an attacker crafts a malicious HTTP GET or POST request targeting the /admin/key.php endpoint. By appending SQL syntax—such as ' OR 1=1-- or UNION SELECT statements—to the ID argument, the attacker influences the logic of the database query executed by the server. Because the input is concatenated directly into the query string, the database interpreter fails to differentiate between legitimate data and malicious SQL commands.\nThe root cause is a lack of input validation and the absence of an abstraction layer that enforces separation between code and data. This allows for arbitrary command execution within the context of the database user configured for the application. The vulnerability is remotely accessible and does not require pre-existing session credentials, making it a high-value target for automated scanners and manual exploitation.\nUpon successful injection, the attacker can perform database fingerprinting, dump entire table structures, extract sensitive applicant credentials, or modify administrative configurations. In certain server configurations, if the database user possesses elevated privileges (e.g., FILE or SUPER privileges), the attacker might attempt to achieve remote code execution (RCE) on the underlying host OS by writing webshells to the web root or executing system-level commands. This vulnerability represents a fundamental flaw in the application's data-handling layer, rendering it susceptible to traditional query manipulation attacks."
}