CVE-2026-105254: itsourcecode Online Admission System schoolyear.php sql injection
A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of itsourcecode Online Admission System 1.0 with the /admin/schoolyear.php endpoint reachable over the network are exposed. Exploitation requires privileges, as reflected by the PR:L vector.
What does an attacker need to exploit it?
An attacker needs low-level privileges and network access to send a crafted sy argument to /admin/schoolyear.php. No user interaction is required, and the attack complexity is low.
How urgent is remediation?
The issue is rated medium severity with a CVSS score of 6.3 and can affect confidentiality, integrity, and availability at low impact levels. A public exploit is available, which increases the likelihood of exploitation.