CVE-2026-105172: SQL Injection in itsourcecode Online Admission System

The vulnerability CVE-2026-105172 affects itsourcecode Online Admission System version 1.0. It is a SQL injection flaw in the /login1.php script, specifically via the User parameter. This allows an unauthenticated remote attacker to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 score is 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. Public exploit code exists, but no vendor patch or fix details are available.

Successful exploitation can lead to unauthorized SQL command execution on the backend database, potentially exposing or modifying sensitive data. The impact is limited to the confidentiality, integrity, and availability of the system as indicated by the CVSS vector. No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint if possible and monitor for suspicious activity related to SQL injection attempts. Avoid using the affected version in production environments if feasible.