CVE-2026-105184: Online Admission System 1.0 SQL Injection

CVE-2026-105184 Overview

CVE-2026-105184 is a SQL injection vulnerability in itsourcecode Online Admission System 1.0. The flaw resides in the /admin/creteria.php script, where the ID parameter is passed to a database query without proper sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse against exposed deployments. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated attackers can inject SQL through the ID parameter in /admin/creteria.php, potentially exposing or altering records in the admission database.

Affected Products

itsourcecode Online Admission System 1.0
Component: /admin/creteria.php
Parameter: ID

Discovery Timeline

2026-10-05 - CVE-2026-105184 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105184

Vulnerability Analysis

The vulnerability exists in an administrative endpoint of the Online Admission System, a PHP-based web application. The /admin/creteria.php script accepts the ID parameter from an HTTP request and concatenates it into a SQL statement without parameterization or input validation. An attacker supplying crafted input can alter the query logic.

Successful exploitation permits reading, modifying, or deleting data within the backend database. Because the affected file sits under the /admin/ path yet does not require prior authentication for exploitation per the public disclosure, attackers can reach it over the network. The impact spans confidentiality, integrity, and availability of admission records.

Root Cause

The root cause is improper neutralization of user-supplied input placed into a SQL query. The application constructs the query string by concatenating the ID parameter directly, rather than using prepared statements or escaping functions. This pattern allows attacker-controlled syntax to be interpreted as part of the query.

Attack Vector

Exploitation requires only network access to the application and the ability to issue HTTP requests to /admin/creteria.php with a manipulated ID value. No credentials and no user interaction are needed according to the public disclosure. Typical payloads use UNION-based or boolean-based techniques to extract data from the database. Further technical context is available in the VulDB CVE Report and the GitHub Issue Discussion.

Detection Methods for CVE-2026-105184

Indicators of Compromise

HTTP requests to /admin/creteria.php containing SQL metacharacters such as ', --, UNION, SELECT, or SLEEP( in the ID parameter.
Web server logs showing unusually long ID values or encoded payloads (%27, %20OR%201=1).
Database error messages or stack traces returned to clients when probing /admin/creteria.php.
Anomalous spikes in query volume or response times associated with the admissions database.

Detection Strategies

Deploy signatures in a web application firewall (WAF) that match SQL injection patterns against the ID parameter of /admin/creteria.php.
Enable query logging on the backend database and alert on syntactically unusual statements originating from the admissions app.
Correlate web access logs with database audit logs to identify requests that produced oversized result sets.

Monitoring Recommendations

Monitor outbound data volume from the application server for signs of bulk data extraction.
Track administrative page access patterns, including source IPs that reach /admin/ paths without prior authentication flows.
Alert on repeated HTTP 500 responses from /admin/creteria.php, which may indicate SQL error-based probing.

How to Mitigate CVE-2026-105184

Immediate Actions Required

Restrict access to /admin/creteria.php using network ACLs, VPN, or IP allow-listing until a fix is applied.
Place the application behind a WAF with SQL injection rules enabled and tuned to the ID parameter.
Review web and database logs for evidence of prior exploitation using the indicators listed above.
Rotate database credentials and administrative passwords if compromise is suspected.

Patch Information

No vendor patch has been published in the enriched CVE data. Monitor the IT Source Code Resource site and the VulDB Vulnerability Details page for future fix announcements. Until an official patch is released, operators should treat the application as unsafe for internet-facing deployment.

Workarounds

Modify /admin/creteria.php to use prepared statements with bound parameters (for example, PDO or mysqli parameterized queries).
Enforce strict server-side input validation on the ID parameter, accepting only integer values.
Run the database account used by the application with the least privilege required, removing unnecessary write or administrative rights.
Disable detailed SQL error output in production to reduce information leakage during exploitation attempts.

bash

# Example nginx snippet to block obvious SQLi patterns on the vulnerable endpoint
location = /admin/creteria.php {
    if ($args ~* "(union|select|sleep\(|--|%27|')") {
        return 403;
    }
    # Optional: restrict to trusted admin network
    allow 10.0.0.0/8;
    deny all;
}