CVE-2026-105254: SQL Injection in itsourcecode Online Admission System

This vulnerability affects itsourcecode Online Admission System version 1.0. It arises from improper sanitization of the 'sy' parameter in the /admin/schoolyear.php file, enabling remote attackers to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating it is remotely exploitable with low attack complexity and no user interaction required. Public exploit code exists, but there is no evidence of widespread exploitation. No vendor advisory or patch information is available.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without user interaction and requires low privileges. However, the overall impact is rated medium due to limited details on the affected functionality and no known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement input validation and sanitization on the 'sy' parameter in /admin/schoolyear.php to mitigate SQL injection risks. Monitor for vendor updates and apply patches promptly once released.