CVE-2026-105253: SQL Injection in itsourcecode Online Admission System Project

The vulnerability CVE-2026-105253 affects itsourcecode Online Admission System Project version 1.0. It is an SQL injection issue caused by improper handling of the User parameter in the /admin/login1.php script. This allows an unauthenticated remote attacker to inject SQL commands, potentially compromising the backend database. The CVSS 4.0 score is 6.9 (medium severity), indicating a network attack vector with low complexity and no privileges or user interaction required. Exploit code has been publicly disclosed, but there is no indication of active exploitation in the wild or an available patch.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. However, the impact is rated medium due to the low complexity and limited scope indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the /admin/login1.php endpoint and implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the User parameter.