CVE-2026-105181: itsourcecode Online Admission System SQL injection in register1.php

CVE-2026-105181 · Severity: medium · CVSS 6.3 · Published 2026-10-05

The Online Admission System is a PHP/MySQL web application used for student registration and admissions processing. An attacker can inject malicious SQL commands through the fname parameter in the registration form to read, modify, or delete database records, including sensitive student information and credentials. Exploitation requires valid login credentials but the attack is publicly documented with working proof-of-concept code.

Technologies: Itsourcecode Online Admission System. Vendors: Itsourcecode.

Quick answers

Is CVE-2026-105181 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105181 being exploited in the wild.
How severe is CVE-2026-105181?
Medium severity, with a CVSS score of 6.3, published 5 October 2026.
Which products and versions are affected?
Itsourcecode Online Admission System 1.0.
Is there a fix for CVE-2026-105181?
No fixed version is recorded yet. Use prepared statements and parameter binding to separate SQL code from user input. Implement strict input validation to ensure the fname field matches expected formats (e.g., alphabetic characters only). Apply the principle of least privilege to the database user account used by the application to minimize the impact of successful injection attacks. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105181 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-105181?
Check whether you run Itsourcecode Online Admission System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Use prepared statements and parameter binding to separate SQL code from user input. Implement strict input validation to ensure the fname field matches expected formats (e.g., alphabetic characters only). Apply the principle of least privilege to the database user account used by the application to minimize the impact of successful injection attacks.

Technical details

A SQL injection vulnerability exists in the fname parameter of /register1.php due to insufficient input validation and sanitization before SQL query construction. An authenticated attacker can craft malicious SQL payloads to execute arbitrary queries against the backend MySQL database. The application fails to use prepared statements or parameterized queries, allowing attackers to manipulate SQL syntax directly.

Affected products

  • itsourcecode Online Admission System 1.0

Timeline

  • 2026-09-10: disclosed
  • 2026-10-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.