CVE-2026-108928
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated remote attackers can read or modify the underlying database via SQL injection. They only need low-privilege network access to reach the vulnerable admin endpoint.
Root cause
The ID parameter in /admin/sum.php is concatenated directly into SQL queries without sanitization or parameterization.
Affected systems
itsourcecode Online Admission System 1.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patch version is documented. Restrict network access to /admin/sum.php or sanitize the 'ID' input parameter using prepared statements in the application code.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file /admin/sum.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.