Description

A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-05T09:17:11.947Z",
  "pubdate": "2026-10-05T09:17:11.947Z",
  "executiveSummary": "The itsourcecode Online Admission System version 1.0 contains a critical SQL injection vulnerability within the /admin/schoolyear.php file.\nThe vulnerability resides in the improper neutralization of the 'sy' argument, which is processed by the backend database without sufficient sanitization or parameterization.\nThis flaw allows a remote, unauthenticated attacker to manipulate SQL queries, potentially leading to unauthorized data exfiltration, modification, or destruction of the database contents.\nThe risk is significantly elevated by the public availability of an exploit, making the system susceptible to automated scanning and opportunistic exploitation.\nSuccessful exploitation compromises the integrity and confidentiality of the application's data layer, potentially facilitating broader system compromise.",
  "technicalDetails": "The vulnerability is a classic SQL injection (SQLi) resulting from insecure handling of user-supplied input. Specifically, the 'sy' parameter in the /admin/schoolyear.php file is utilized directly within a database query without the implementation of prepared statements, parameterized queries, or robust input validation mechanisms.\nThe exploitation flow begins with an attacker crafting a malicious HTTP request directed at the /admin/schoolyear.php endpoint. By appending specifically formatted SQL commands to the 'sy' argument—such as UNION SELECT statements or boolean-based blind injection payloads—the attacker can alter the structure of the original SQL query executed by the backend database.\nBecause the application fails to enforce type casting or character filtering, the database engine interprets the malicious input as legitimate SQL instructions. This allows an attacker to bypass authentication logic, extract sensitive administrative credentials, or access restricted tables containing personal student information.\nThe attack is remotely exploitable over HTTP/HTTPS, requiring no specific privileges or prior authentication to initiate. The impact of such an injection extends to full database compromise, including the ability to perform Data Manipulation Language (DML) operations (INSERT, UPDATE, DELETE) or Data Definition Language (DDL) operations (DROP, ALTER), depending on the permissions granted to the database user account utilized by the application.\nPost-exploitation, an attacker can leverage the database access to execute further malicious actions, such as administrative account takeover, which facilitates unauthorized access to the broader application administration panel. Given that the exploit code is publicly documented, the window for remediation is minimal, and the vulnerability serves as a direct vector for data breach scenarios."
}