CVE-2026-105172: Online Admission System 1.0 SQLi Vulnerability

CVE-2026-105172 Overview

CVE-2026-105172 is a SQL injection vulnerability in itsourcecode Online Admission System 1.0. The flaw resides in the /login1.php endpoint, where the User parameter is passed to a database query without proper sanitization. Attackers can inject arbitrary SQL statements remotely without authentication. A public exploit is available, increasing the likelihood of opportunistic attacks against exposed installations. The weakness is categorized under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated remote attackers can manipulate backend SQL queries through the login form, potentially exposing admission records, bypassing authentication, or modifying database contents.

Affected Products

itsourcecode Online Admission System 1.0
Vulnerable file: /login1.php
Vulnerable parameter: User

Discovery Timeline

2026-10-05 - CVE-2026-105172 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105172

Vulnerability Analysis

The vulnerability stems from unsanitized user input being concatenated into a SQL statement inside /login1.php. When a client submits credentials, the User parameter is embedded into the authentication query without parameterization or input validation. An attacker can supply SQL metacharacters to alter the structure of the query. This allows authentication bypass through classic payloads such as tautologies, as well as data extraction using UNION-based or error-based techniques. The attack surface is reachable over the network with no privileges or user interaction required.

Root Cause

The root cause is improper neutralization of special elements within the login handler. The application constructs SQL queries using string concatenation rather than prepared statements with bound parameters. Any single quote, comment sequence, or SQL keyword passed through the User field is interpreted as part of the query. The absence of a whitelist filter or type validation leaves the backend database directly exposed to injected clauses.

Attack Vector

The attack is initiated remotely over HTTP by submitting a crafted POST request to /login1.php. The adversary places a SQL payload in the User form field. Typical exploitation flows include authentication bypass by injecting an always-true condition, enumeration of database schema via UNION SELECT, and extraction of sensitive student or admin records. Because the exploit is public, mass-scanning tooling can automate discovery and compromise.

See the VulDB entry for CVE-2026-105172 and the GitHub issue tracker for additional technical references.

Detection Methods for CVE-2026-105172

Indicators of Compromise

HTTP POST requests to /login1.php containing SQL metacharacters such as single quotes, --, #, OR 1=1, or UNION SELECT in the User parameter.
Unusual database error messages returned by the application and surfaced in web server logs.
Successful authentications against the admission system from unexpected IP addresses or without a matching legitimate username.

Detection Strategies

Deploy web application firewall (WAF) signatures that inspect POST bodies to /login1.php for SQL injection patterns.
Enable database query logging and alert on unusual query shapes originating from the admission system account, such as queries containing comment terminators or stacked statements.
Correlate failed login spikes followed by a successful login from the same source as a potential bypass indicator.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for retention and correlation.
Baseline normal login traffic volumes and alert on deviations in request size, frequency, or payload entropy targeting /login1.php.
Monitor outbound connections from the database host to detect post-exploitation data exfiltration.

How to Mitigate CVE-2026-105172

Immediate Actions Required

Restrict public exposure of the Online Admission System by placing it behind a VPN or IP allowlist until a fix is applied.
Deploy WAF rules to block SQL injection payloads targeting the User parameter on /login1.php.
Audit the admission system database for unauthorized accounts, modified records, or signs of prior exploitation.

Patch Information

No vendor patch has been published at the time of CVE assignment. Administrators should monitor the itsourcecode website and the VulDB vulnerability record for remediation guidance. Where source code access is available, replace string-concatenated SQL in /login1.php with prepared statements using parameter binding, and apply strict input validation on the User field.

Workarounds

Modify /login1.php to use parameterized queries (for example, PDO prepared statements or mysqli_prepare) in place of direct string concatenation.
Enforce input validation that restricts the User field to an expected character set and maximum length.
Apply least-privilege database accounts so the web application cannot read sensitive tables or execute administrative statements.
Disable detailed database error messages in production responses to reduce information disclosure to attackers.

bash

# Example Apache mod_security rule to block common SQLi patterns on the login endpoint
SecRule REQUEST_URI "@streq /login1.php" \
  "id:1050001,phase:2,deny,status:403,\
   chain,msg:'Potential SQL injection against Online Admission System login'"
  SecRule ARGS:User "@rx (?i)(\bunion\b.*\bselect\b|\bor\b\s+1=1|--|#|;)" \
    "t:none,t:urlDecodeUni"