CVE-2026-105183: SQL Injection in itsourcecode Online Admission System

The vulnerability CVE-2026-105183 affects itsourcecode Online Admission System 1.0. It is a SQL injection issue caused by improper handling of the 'schedid' argument in an unknown function within the /admin/confirm.php file. This allows remote attackers to inject SQL code, potentially compromising the backend database. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality, integrity, and availability impacts. Exploit code has been publicly released, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or disruption of service. The impact is rated medium based on the CVSS score of 6.9 and the described low confidentiality, integrity, and availability impacts.

No official patch or remediation has been provided by the vendor for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing input validation and parameterized queries as a temporary mitigation to prevent SQL injection via the 'schedid' parameter.